Sign In

CVE-2026-94646

ADVISORY - nist

Summary

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-1284⁠

Improper Validation of Specified Quantity in Input

CWE-1321⁠

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-248⁠

Uncaught Exception

ADVISORY - redhat

CWE-915⁠

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impacted images

Advisories

NIST

CREATED

UPDATED

ADVISORY IDCVE-2026-94646⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-1284⁠CWE-1321⁠CWE-248⁠

CVSS SCORE

8.7high

Debian

CREATED

UPDATED

ADVISORY IDCVE-2026-94646⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Red Hat

CREATED

UPDATED

ADVISORY IDCVE-2026-94646⁠
EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-915⁠

CVSS SCORE

7.5high