HIGH 8.7 NVD

CVE-2026-94646

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution'

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8

Published: 2026-10-02 · Source: NVD · Feed updated: 2026-10-02

This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-02 via NVD.

vulnfeed aggregates 10476 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.