CVE-2026-55968: Apache Thrift Node.js DOS Vulnerability

CVE-2026-55968 Overview

CVE-2026-55968 is a denial-of-service vulnerability in the Apache Thrift Node.js bindings. The flaw stems from inefficient algorithmic complexity and unbounded resource allocation [CWE-407] when processing untrusted input. Remote attackers can send crafted network payloads that force the Node.js server into excessive CPU or memory consumption. The issue affects all Apache Thrift releases before 0.24.0. The Apache Software Foundation has released version 0.24.0 to remediate the defect. The vulnerability is network-exploitable, requires no authentication, and no user interaction.

Critical Impact
Unauthenticated remote attackers can exhaust CPU and memory on Apache Thrift Node.js servers, disrupting availability of any dependent service.

Affected Products

Apache Thrift Node.js bindings, all versions before 0.24.0
Applications and services that embed the vulnerable Thrift Node.js library
Downstream distributions packaging Apache Thrift prior to 0.24.0

Discovery Timeline

2026-07-27 - CVE-2026-55968 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-55968

Vulnerability Analysis

Apache Thrift is a cross-language remote procedure call (RPC) framework used to define services and serialize data between clients and servers. The Node.js bindings implement the framework's transport and protocol layers in JavaScript. In releases before 0.24.0, these bindings process incoming Thrift messages without enforcing effective limits on request size or structural complexity.

An attacker who can reach a Thrift endpoint may submit malformed or maliciously structured payloads that trigger algorithmic paths whose cost grows disproportionately with input size. Combined with the absence of allocation throttling, this produces sustained CPU load or unbounded memory growth on the Node.js event loop. Because Node.js uses a single-threaded execution model, one hostile connection can stall all concurrent request handling and render the service unresponsive.

The vulnerability affects only availability. It does not permit code execution, data disclosure, or integrity impact. Public exploitation has not been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a combination of two weaknesses categorized under [CWE-407]. First, message-handling routines in the Node.js bindings use algorithms whose worst-case complexity is not bounded relative to input size. Second, the code path allocates buffers and container structures based on attacker-supplied lengths without validating them against a maximum threshold. Version 0.24.0 introduces limits and more efficient processing to address both conditions.

Attack Vector

Exploitation requires only network access to a Thrift service built on the vulnerable Node.js bindings. The attacker sends a crafted Thrift protocol message containing oversized or deeply nested structures. The server consumes CPU and memory processing the message, degrading or halting service. No credentials, tokens, or prior session state are required.

No verified proof-of-concept code has been published. See the Apache Mailing List Thread and the OpenWall OSS Security Discussion for the vendor's technical description.

Detection Methods for CVE-2026-55968

Indicators of Compromise

Sudden and sustained CPU saturation on Node.js processes hosting Thrift services with no corresponding increase in legitimate traffic
Rapid memory growth or out-of-memory terminations of Thrift service processes
Long-lived TCP connections to Thrift ports that transmit small volumes of data but produce heavy server load
Event-loop lag warnings or health-check timeouts on services embedding Apache Thrift below 0.24.0

Detection Strategies

Inventory all Node.js applications and container images and identify those importing the thrift package at versions earlier than 0.24.0
Correlate application performance monitoring (APM) event-loop metrics with network flow data to detect single sources triggering resource spikes
Deploy network monitoring rules that flag oversized Thrift frames or abnormal message-field counts on known Thrift ports

Monitoring Recommendations

Establish baselines for CPU, resident memory, and event-loop latency on each Thrift service and alert on deviation
Log source IP, request size, and processing time for every Thrift call to enable retrospective analysis
Forward process telemetry to a centralized data lake so that anomalous resource patterns can be pivoted against network telemetry

How to Mitigate CVE-2026-55968

Immediate Actions Required

Upgrade the thrift Node.js package to version 0.24.0 or later across all environments
Rebuild and redeploy container images that bundle Apache Thrift to eliminate cached vulnerable copies
Restrict network exposure of Thrift endpoints to trusted clients until patching is complete
Enable rate limiting and connection quotas at the load balancer or reverse proxy in front of Thrift services

Patch Information

The Apache Software Foundation fixed the issue in Apache Thrift 0.24.0. Users are advised to upgrade immediately. Release details are available in the Apache Mailing List Thread.

Workarounds

Place Thrift services behind a reverse proxy that enforces maximum request size and per-client rate limits
Terminate long-running or oversized Thrift connections using edge timeouts
Isolate Thrift workers in containers with strict CPU and memory cgroup limits so that a single abusive client cannot exhaust the host
Restrict inbound access to Thrift ports using network segmentation and allowlists until the upgrade is deployed

bash

# Upgrade the Node.js Thrift bindings to the fixed release
npm install thrift@0.24.0 --save
npm ls thrift