TI-2026-30157 Aliases CVE-2026-41636 GHSA-r67j-r569-jrwp

Apache Thrift: Node.js skip() recursion

MEDIUM 44CWE-674Published 2026-04-28 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 5 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00451 39th percentileScored 2026-11-07

Fix Partial Apache Thrift (Apache Software Foundation): 0.23.0thrift (npm): 0.23.0Red Hat: 5 advisoriesRed Hat: 5 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Thrift	before 0.23.0	0.23.0	Patch available	CNA
—	thrift (npm)	before 0.23.0	0.23.0	Patch available	GHSA-r67j-r569-jrwp

Apache Thrift VendorApache Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA
thrift (npm) Vendor— Affected before 0.23.0 Fixed in 0.23.0 Patch available GHSA-r67j-r569-jrwp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:thrift::::::node.js::*	before 0.23.0	Vulnerable	Apache

cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:* Versions before 0.23.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.23.0
Fix · GHSA-r67j-r569-jrwp thrift (npm) Fixed in 0.23.0 Advisory →

Red Hat 5 advisories

RHSA-2026:24539 Released 2026-06-08 · Red Hat rating Important
Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
Multicluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
RHSA-2026:22423 Released 2026-06-02 · Red Hat rating Important
Multicluster Global Hub 1.3.4 security update
- Multicluster Global Hub 1.3.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Show 2 more Red Hat advisories

RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
Multicluster Global Hub 1.4.5 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
Multicluster Global Hub 1.5.4 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-04-28
Apache Thrift — lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql
7 records Highest priority Priority MEDIUM 5 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-30145 Apache Thrift: Swift Range crash in skip()Priority MEDIUM 43
- TI-2026-30144 Apache Thrift: Go TFramedTransport uint32 overflowPriority MEDIUM 41
- TI-2025-30732 Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.Priority MEDIUM 41
Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AI Inference Server	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift GitOps	Affected	No fix planned: Will not fix
Red Hat OpenShift distributed tracing 3	Affected	No fix planned: Will not fix
Multicluster Global Hub 1.3.4	Fixed	RHSA-2026:22423
Multicluster Global Hub 1.4.9	Fixed	RHSA-2026:22347
Multicluster Global Hub 1.5.8	Fixed	RHSA-2026:21769
Multicluster Global Hub 1.6.6	Fixed	RHSA-2026:23345
Red Hat Advanced Cluster Management for Kubernetes 2.15	Fixed	RHSA-2026:24539

Not affected: 9 products

Multicluster Global Hub 1.3.4
Multicluster Global Hub 1.4.9
Multicluster Global Hub 1.5.8
Multicluster Global Hub 1.6.6
OpenShift Service Mesh 2
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenShift distributed tracing 3

Timeline

2026-10-02 Threatist record created from CVE-2026-41636
2026-10-03 Alias added: GHSA-r67j-r569-jrwp
2026-10-25 EPSS moved to the below the 50th percentile
2026-10-30 Fix available: Multicluster Global Hub 1.5.8, Multicluster Global Hub 1.6.6 · Red Hat

References

Patch 1

https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41636

Other 2

TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences