CVE-2026-94646: apache software foundation apache thrift Uncaught Exception

Vulnerability summary

CVE-2026-94646 is a high (CVSS 8.7) Uncaught Exception vulnerability in apache software foundation apache thrift. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities.

Timeline

1. 02-10-2026
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
• CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
• CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.