Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-86536

Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Thrift

Default version status: unaffected

  • 0 to < 0.25.0affected
pkg:npm/thrift

Apache Software Foundation Apache Thrift

Default version status: unaffected

  • 0 to < 0.25.0affected

Apache Software Foundation Apache Thrift

Default version status: unaffected

  • 0 to < 0.25.0affected

References