CVE-2026-41636: Apache Thrift: Node.js skip() recursion
Analyzed
AliasesUBUNTU-CVE-2026-41636DEBIAN-CVE-2026-41636GHSA-r67j-r569-jrwpBIT-thrift-2026-41636CGA-2695-37h2-hw3qCGA-26vq-qcwq-vwwvCGA-27gv-p22h-67h8CGA-2867-c6rp-x3fmCGA-288w-4q3j-72jgCGA-2c7p-f233-mpq6CGA-2j73-wqr4-3mcwCGA-2v2m-282m-mmh7CGA-2xrx-crq4-h4q2CGA-38qj-24ph-j6r2CGA-3grw-f467-6r28CGA-44cp-w98x-rpxgCGA-456r-79p4-m5vgCGA-4jch-f4q8-rpwjCGA-4qq3-qqcw-2r46CGA-54mj-qw4j-wf59CGA-59vh-q2mx-fvw4CGA-5r96-x835-vqp2CGA-636r-9w3x-x3fpCGA-637j-9h48-7wr7CGA-6f3h-jr4x-g875CGA-753c-63jg-w682CGA-7666-5w6q-5fvxCGA-7rfm-23rr-hrpcCGA-7w4q-46p7-6v2pCGA-7x2m-wqcc-qf87CGA-83f6-cpj8-5pj5CGA-85cv-4gfx-c95gCGA-88jh-w6jm-f746CGA-8c5f-79rw-34xpCGA-958v-c45f-9x39CGA-95rg-4q26-hr5gCGA-9f5h-3g3r-g57rCGA-9j42-fw64-cpfgCGA-9vx5-89rr-qvg4CGA-c6hf-r2v5-mh9rCGA-cv9v-vmc8-q3jpCGA-ff27-48v9-6vrmCGA-fjp2-c6q7-qqm6CGA-fqwp-m66q-7732CGA-fwmv-3wrw-x7w5CGA-fwv7-4ggf-hr35CGA-g26j-5945-3973CGA-g4fh-grhq-9gpwCGA-h4mq-h942-2vgmCGA-h5rh-72xm-rr7mCGA-hv73-pppr-3c5mCGA-j72q-2g2p-fcx8CGA-jvq8-3hwr-qwrrCGA-mq29-65jc-gg73CGA-mqhq-6v9f-25q8CGA-mqxm-4wx8-7hwqCGA-mwpm-j2c3-732wCGA-mwvr-cxm5-884qCGA-p3qp-cj9c-3qm7CGA-p44c-8xmx-pw4mCGA-pp6w-qc57-m3qrCGA-vg53-8838-39p2CGA-x2vj-9v23-5vr5CGA-xx74-g5vc-wxm2CGA-pwcx-2qgv-2w53CGA-px67-fp7q-mfwqCGA-px7m-x3rw-v8gjCGA-q3vx-rf6m-hr37CGA-qvqf-rfq8-mpcjCGA-qwx2-9x8r-3xcfCGA-rh79-8j73-3rr7CGA-rxwq-q7px-m7vwCGA-v8x9-c2mf-xp98CGA-w3cf-vx7m-6pv9CGA-w9v3-2gh6-2c6fCGA-ww55-23hc-mcrgCGA-x92j-965m-7jjxCGA-xjhp-m23m-hv3cCGA-xr3c-9p83-qf96CGA-xv47-f389-x8g2CGA-4jwv-xcfq-53rpCGA-4x3f-23hr-rp5xCGA-83c2-6r7c-fcc6CGA-pm3m-g3f5-8xvjCGA-g6jv-wx94-cp6fCGA-j73w-gffm-jvr3CGA-wvpp-8cxv-2jw7CGA-4c68-74v7-66rgALPINE-CVE-2026-41636
Published 28-04-2026Last modified 31-10-2026
Vulnerability summary
CVE-2026-41636 is a high (CVSS 8.7) Uncontrolled Recursion vulnerability in apache software foundation apache thrift. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.45%
0%100%
Low · -0.28 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 28-04-2026PublishedVulnerability first disclosed.
- 31-10-2026Last modifiedVulnerability information updated.
Description
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVSS metrics
9 scores · 7 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:LSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
Decrease -0.28 pp
From 0.73% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard42 products
- commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.4All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.5All versions (No fix recorded)
Alpine1 product
- thrift< 0.23.0-r0
Apache1 product
- thrift< 0.23.0
Apache software foundation1 product
- apache thrift< 0.23.0
Debian1 product
- thriftAll versions (No fix recorded) | < 0.23.0-3
Npm1 product
- thrift< 0.23.0
Ubuntu1 product
- thriftAll versions (No fix recorded)
7 vendors · 48 products
References
10 links- lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwqlVendor AdvisoryWEBAdvisoryMailing ListPatchRelease Notes
- github.com/apache/thriftPACKAGE