CVE-2026-86536
Description
A flaw was found in Apache Thrift's JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability—where shared JavaScript object definitions are modified—by sending specially crafted input to an application using the affected bindings. Successful exploitation may allow an attacker to alter application logic or cause unexpected behavior.
Statement
Red Hat has evaluated this vulnerability as having a Moderate severity because exploitation requires an application to deserialize attacker-supplied data via the affected JavaScript bindings, potentially altering object properties and internal program logic rather than enabling direct code execution. In typical Red Hat deployments, Apache Thrift is primarily used for backend service communication across compiled native or Python implementations, which remain unaffected. Systems are only exposed if custom or third-party Node.js and browser applications consume untrusted Thrift payloads.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
