CVE-2026-41636: Apache Thrift Recursion Vulnerability

CVE-2026-41636 Overview

An Uncontrolled Recursion vulnerability has been identified in Apache Thrift Node.js bindings. This security flaw allows attackers to trigger excessive recursive function calls, potentially leading to stack exhaustion and denial of service conditions. The vulnerability affects all versions of Apache Thrift prior to 0.23.0.

Apache Thrift is a widely-used cross-language services development framework that enables efficient communication between different programming languages. The Node.js bindings are particularly popular in modern microservices architectures, making this vulnerability relevant to many enterprise environments.

Critical Impact

Remote attackers can exploit this uncontrolled recursion to cause denial of service through stack exhaustion, potentially disrupting critical services relying on Apache Thrift Node.js bindings.

Affected Products

• Apache Thrift versions before 0.23.0
• Apache Thrift Node.js bindings (cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:*)
• Applications and services using vulnerable Apache Thrift Node.js libraries

Discovery Timeline

• 2026-04-28 - CVE-2026-41636 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41636

Vulnerability Analysis

This vulnerability is classified as CWE-674 (Uncontrolled Recursion), which occurs when a function calls itself repeatedly without proper termination conditions or depth limits. In the context of Apache Thrift Node.js bindings, specially crafted input data can trigger recursive parsing or processing operations that consume stack memory until exhaustion occurs.

The network-based attack vector means that remote attackers can send malicious payloads to any service using vulnerable Thrift Node.js bindings without requiring authentication or user interaction. This makes it particularly dangerous in internet-facing services or internal microservices architectures.

The primary impact is availability loss through denial of service. When the recursion exceeds the stack limit, the Node.js process will crash, terminating all active connections and service operations. In environments without proper process supervision, this could result in extended downtime.

Root Cause

The root cause lies in insufficient recursion depth validation within the Apache Thrift Node.js bindings. When processing nested data structures or certain message formats, the parsing logic recursively processes elements without enforcing maximum depth limits. An attacker can construct deeply nested structures that exceed the stack capacity of the Node.js runtime.

This type of vulnerability commonly occurs in serialization/deserialization libraries where hierarchical data formats are processed recursively without considering adversarial input that maximizes nesting depth.

Attack Vector

The attack is network-based and can be exploited remotely. An attacker crafts a Thrift message containing deeply nested structures or recursive references designed to exhaust the call stack. When a vulnerable Thrift service receives and attempts to deserialize this payload, the recursive parsing function is invoked repeatedly until the stack is exhausted, causing the process to crash.

The attack does not require authentication or any special privileges, and no user interaction is needed. This makes it a straightforward denial of service attack against any exposed Thrift Node.js service.

The vulnerability mechanism involves recursive descent parsing of nested Thrift structures. When a malicious payload with excessive nesting depth is received, the parser recurses into each nested level without checking depth limits, eventually causing stack overflow and process termination. For technical details, see the Apache Mailing List Thread.

Detection Methods for CVE-2026-41636

Indicators of Compromise

• Unexpected Node.js process crashes with stack overflow errors in Thrift-based services
• Error logs showing "Maximum call stack size exceeded" exceptions in Thrift parsing code
• Unusual network traffic containing abnormally large or deeply nested Thrift messages
• Service restart patterns correlating with incoming network requests

Detection Strategies

• Monitor application logs for stack overflow exceptions and unexpected process terminations in services using Apache Thrift
• Implement network-level inspection for abnormally sized Thrift payloads or messages with excessive nesting indicators
• Deploy application performance monitoring to detect recursive function depth anomalies before crash conditions
• Use SentinelOne Singularity to detect process crash patterns and anomalous behavior in Node.js services

Monitoring Recommendations

• Configure alerting for Node.js process crashes and automatic restarts in Thrift service environments
• Establish baseline metrics for Thrift message sizes and complexity to identify outliers
• Monitor memory and stack usage in Node.js processes running Thrift bindings
• Implement health checks that can detect service degradation before complete denial of service occurs

How to Mitigate CVE-2026-41636

Immediate Actions Required

• Upgrade Apache Thrift to version 0.23.0 or later immediately
• Audit all applications and services for use of Apache Thrift Node.js bindings
• Implement process supervision to automatically restart crashed services while patching is in progress
• Consider temporarily isolating vulnerable Thrift services behind additional network controls

Patch Information

Apache has released version 0.23.0 which addresses this uncontrolled recursion vulnerability. Users are strongly recommended to upgrade to this version or later. The fix implements proper recursion depth limits to prevent stack exhaustion attacks.

For additional information, refer to the Apache Mailing List Thread and the Openwall OSS-Security Update.

Workarounds

• Implement network-level rate limiting and payload size restrictions on Thrift service endpoints
• Deploy a reverse proxy or API gateway that can inspect and reject abnormally nested payloads
• Use process managers like PM2 or systemd with automatic restart policies to minimize downtime during attacks
• Implement application-level message validation before passing data to Thrift deserializers

# Configuration example - Update Apache Thrift in Node.js projects
npm update thrift@0.23.0
# Or specify in package.json
# "thrift": ">=0.23.0"

# Verify installed version
npm list thrift