← All advisories

High severity7.5NVD Advisory· Published Apr 28, 2026· Updated Apr 28, 2026

CVE-2026-41636

CVE-2026-41636

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
thriftnpm	< 0.23.0	0.23.0

Affected products

9

Apache/Thrift
cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:*
Range: <0.23.0
osv-coords8 versions
pkg:apk/chainguard/gitlab-rails-ce-assets-18.10 pkg:apk/chainguard/gitlab-rails-ce-assets-18.11 pkg:apk/chainguard/gitlab-rails-ce-assets-18.9 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.10 pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.11 pkg:bitnami/thrift pkg:npm/thrift pkg:rpm/opensuse/thrift&distro=openSUSE%20Tumbleweed
< 0+ 7 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 18.9.6-r2
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.23.0
- (no CPE)range: < 0.23.0
- (no CPE)range: < 0.23.0-1.1

Patches

Vulnerability mechanics

References

4

lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwqlnvdMailing ListPatchRelease NotesWEB
github.com/advisories/GHSA-r67j-r569-jrwpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-41636ghsaADVISORY
www.openwall.com/lists/oss-security/2026/04/28/1nvdMailing ListWEB

News mentions

0

No linked articles in our index yet.