CVE-2026-86536
published 2026-10-02CVE-2026-86536: Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects…
PriorityP337medium6.3CVSS 4.0
AVNACLATPPRNUINVCNVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
22.4th percentile
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: thrift: Prototype pollution in JavaScript bindings
vendor_redhat·2026-10-02·CVSS 6.3
CVE-2026-86536 [MEDIUM] CWE-915 thrift: thrift: Prototype pollution in JavaScript bindings
thrift: thrift: Prototype pollution in JavaScript bindings
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
A flaw was found in Apache Thrift's JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability—where shared JavaScript object definitions are modified—by sending specially crafted input to an application using the affected bindings. Successful exploitation may allow an attacker to alter application logic or cause unexpected behavior.
Package: thrift (Red Hat Ceph Storage 7) - Fix deferred
Package: thrif
GHSA
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-86536 [MEDIUM] CWE-1321 Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [fedora-all]
bugzilla·2026-10-22·CVSS 6.3
CVE-2026-86536 [MEDIUM] CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [fedora-all]
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Bugzilla
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [epel-all]
bugzilla·2026-10-22·CVSS 6.3
CVE-2026-86536 [MEDIUM] CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [epel-all]
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Bugzilla
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings
bugzilla·2026-10-02·CVSS 6.3
CVE-2026-86536 [MEDIUM] CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings
CVE-2026-86536 thrift: thrift: Prototype pollution in JavaScript bindings
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
2026-10-02
Published