CVE-2026-43870 Apache Thrift: Node.js web_server.js multi-vulnerability
Attackers can exploit path traversal, HTTP splitting, and resource exhaustion in the Node.js web server component of Apache Thrift.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43870?
CVE-2026-43870 is a high-severity path traversal vulnerability in Apache Thrift, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Which versions are affected by CVE-2026-43870?
3 open source packages ship an affected version, including thrift. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
thrift Bitnami | All versions | 0.23.0 |
thrift npm | All versions to 0.22.0 | None |
thrift npm | All versions to 0.22.0 | None |
Products include Apache Thrift.
How do I fix CVE-2026-43870?
Upgrade thrift to 0.23.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-43870 being exploited?
There is no known exploitation of CVE-2026-43870 in the wild and no public exploit code.
Other vulnerabilities in Apache Thrift
- CVE-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
- CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification
- CVE-2016-5397 Apache Thrift Go Library Command Injection
- CVE-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
- CVE-2026-48586 Denial of service in Apache Thrift
Sources
Also known as BIT-thrift-2026-43870, DEBIAN-CVE-2026-43870, GHSA-526f-jxpj-jmg2, MINI-2m7h-pvrx-x847, MINI-9xf9-jx38-6vjg, MINI-rx7f-g837-9vg8 and 1 more.