CVE-2026-94646

{
  "etk_id": "ETK-2026-341",
  "cve_id": "CVE-2026-94646",
  "display_id": "CVE-2026-94646",
  "ghsa_id": "GHSA-pjxr-77cv-5rj7",
  "euvd_id": "EUVD-2026-91563",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Prototype pollution in Apache Thrift Node.js bindings",
  "summary": "Apache Thrift Node.js bindings before version 0.25.0 improperly validate certain input, allowing prototype pollution or uncaught exceptions. An attacker who can provide the affected input may modify object prototype attributes or trigger an exception; no further precondition is stated.",
  "mitigation": "Upgrade Apache Thrift Node.js bindings to version 0.25.0 or later.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "thrift",
      "purl": "pkg:npm/thrift"
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0046,
  "epss_percentile": 0.3854,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.374109116666666,
  "t0_at": "2026-10-02T11:52:21.192000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T11:52:21.192000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T11:52:21.192000+00:00",
      "url": "https://github.com/advisories/GHSA-pjxr-77cv-5rj7"
    }
  }
}