CVE-2026-96294: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
Apache Thrift: nodejs web server: no error listener on an upgraded WebSocket connection
Other sources
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thrift NodeJS bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift NodeJS bindings are affected in versions before 0.25.0. The issue concerns the NodeJS web server handling an upgraded WebSocket connection.
What is the remediation?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.