CVE-2026-41636Published

Apache Thrift: Node.js skip() recursion

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-41636

Published

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Source published: 28 Apr 2026 09:22:14 UTC
Source modified: 28 Apr 2026 12:15:44 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

euvd · EUVD-2026-26026

Published

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 28, 2026, 9:22:14 AM

dateUpdated: Apr 28, 2026, 12:15:44 PM

8 related source bulletins · separate from aliases

RHSA-2026:21769: Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update

CVE-2026-4427 · CVE-2026-21728 · CVE-2026-25679 · CVE-2026-27137 · CVE-2026-27889 · CVE-2026-29785 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-32285 · CVE-2026-32286 · CVE-2026-33186 · CVE-2026-33215 · CVE-2026-33216 · CVE-2026-33217 · CVE-2026-33218 · CVE-2026-33219 · CVE-2026-33247 · CVE-2026-33413 · CVE-2026-33487 · CVE-2026-33810 · CVE-2026-33813 · CVE-2026-33997 · CVE-2026-34040 · CVE-2026-34986 · CVE-2026-40890 · CVE-2026-41602 · CVE-2026-41603 · CVE-2026-41604 · CVE-2026-41605 · CVE-2026-41606 · CVE-2026-41607 · CVE-2026-41636 · CVE-2026-43869

RHSA-2026:24539: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update

CVE-2025-48431 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-40293 · CVE-2026-40890 · CVE-2026-40895 · CVE-2026-41602 · CVE-2026-41603 · CVE-2026-41604 · CVE-2026-41605 · CVE-2026-41606 · CVE-2026-41607 · CVE-2026-41636 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-43869

RHSA-2026:23345: Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update

RHSA-2026:22347: Red Hat Security Advisory: Multicluster Global Hub 1.4.5 security update

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

openSUSE-SU-2026:10685-1: libthrift-0_23_0-0.23.0-1.1 on GA media

CVE-2026-41602 · CVE-2026-41604 · CVE-2026-41605 · CVE-2026-41606 · CVE-2026-41607 · CVE-2026-41636

msrc_CVE-2026-41636: Apache Thrift: Node.js skip() recursion

CVE-2026-41636

RHSA-2026:22423: Red Hat Security Advisory: Multicluster Global Hub 1.3.4 security update

CVE-2026-21728 · CVE-2026-25679 · CVE-2026-27137 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-32285 · CVE-2026-32286 · CVE-2026-33186 · CVE-2026-33487 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-41602 · CVE-2026-41603 · CVE-2026-41604 · CVE-2026-41605 · CVE-2026-41606 · CVE-2026-41607 · CVE-2026-41636 · CVE-2026-43869

Source published: Apr 28, 2026, 9:22:14 AM (timezone not stated)
Source modified: Apr 28, 2026, 12:15:44 PM (timezone not stated)
Observed here: 28 Oct 2026 05:10:25 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

nvd · CVE-2026-41636

Published

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-674

Original publisher date fields

published: 2026-04-28T10:16:03.687

lastModified: 2026-10-26T21:10:00.170

1 source CPE criteria · context only

cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 28 Apr 2026 10:16:03 UTC
Source modified: 26 Oct 2026 21:10:00 UTC
Observed here: 27 Oct 2026 10:10:19 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-r67j-r569-jrwp

Published

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Source published: 28 Apr 2026 12:31:30 UTC
Source modified: 10 Sep 2026 03:51:02 UTC
Observed here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Publisher rating · HIGH