CVE-2026-43870: Apache Thrift: Node.js web_server.js multi-vulnerability
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thrift (Node.js web_server.js)to a version that resolves this vulnerability.Fixed in 0.23.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43870?
CVE-2026-43870 has been classified with a high severity due to its multiple vulnerabilities affecting Apache Thrift.
How do I fix CVE-2026-43870?
To fix CVE-2026-43870, upgrade Apache Thrift to version 0.23.0 or later, addressing the identified vulnerabilities.
What vulnerabilities are included in CVE-2026-43870?
CVE-2026-43870 includes an Origin Validation Error, Path Traversal, HTTP Request/Response Splitting, and Uncontrolled Resource Consumption.
Which versions of Apache Thrift are affected by CVE-2026-43870?
Apache Thrift versions prior to 0.23.0 are affected by CVE-2026-43870.
What potential impacts does CVE-2026-43870 pose?
CVE-2026-43870 can lead to unauthorized access, data exposure, denial of service, and potentially harmful system behavior.