CVE-2026-41636: Apache Thrift: Node.js skip() recursion
Apache Thrift: Node.js skip() recursion
Other sources
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thrift Node.js bindingsto a version that resolves this vulnerability.Fixed in 0.23.0Patch CVE-2026-41636
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41636?
CVE-2026-41636 is categorized as a medium severity vulnerability due to its potential for denial of service through uncontrolled recursion.
How do I fix CVE-2026-41636?
To fix CVE-2026-41636, users should upgrade to Apache Thrift version 0.23.0 or later.
What components are affected by CVE-2026-41636?
CVE-2026-41636 affects the Node.js bindings of Apache Thrift versions prior to 0.23.0.
What type of vulnerability is CVE-2026-41636?
CVE-2026-41636 is classified as an uncontrolled recursion vulnerability.
Can CVE-2026-41636 lead to other security issues?
Yes, CVE-2026-41636 can lead to denial of service conditions, impacting system availability.