CVE-2026-86536: Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
Published Oct 2, 2026
·Updated
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Affected Software
1 affected component
Apache Apache Thrift<0.25.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0 - Operational
Re-generate the JavaScript code after upgrading Apache Thrift.
Event History
Oct 2, 2026
CVE Published
via MITRE·11:40 AM
Data Sourced
via MITRE·11:40 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Apache Thrift deployments using JavaScript bindings are affected if they use a version before 0.25.0. The issue applies to all JS bindings.
2
What is required to remediate the issue?
Upgrade Apache Thrift to version 0.25.0 and re-generate the JavaScript code. Both steps are recommended to obtain the fix.