This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-86536 →

DEBIAN-CVE-2026-86536

Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issu...

Original description

The description as published by the source.

Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org