Search/CVE-2026-94646
● CVE

CVE-2026-94646

DiscoveredOct 2, 2026UpdatedOct 2, 2026

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS v3.1
—
EPSS
0.30%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
Intelligence Reports1
1 intelligence report available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
EPSS Trend
Oct 4, 2026 → Oct 26, 2026
▼ 0.16pp
0.46% → 0.30% over 2 tracked changes
Connections
3 relationships
Timeline
disclosure → media coverage
Oct 2, 2026
Disclosure — published as a CVE record.