CVE-2026-96294: Apache Thrift NodeJS Web Server Error Handling Vulnerability
Summary
CVE-2026-96294: Apache Thrift: nodejs web server: no error listener on an upgraded WebSocket connection. Affects thrift versions < 0.25.0. Fixed in 0.25.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Thrift is a software framework for scalable cross-language services development. It combines a software stack with a code generation engine to build services that can communicate with each other across different programming languages. The NodeJS bindings of Apache Thrift allow developers to create web servers that can handle requests and responses efficiently. However, prior to version 0.25.0, these bindings had a critical vulnerability related to error handling during WebSocket connections.
Vulnerability Detail
The vulnerability arises from the improper handling of exceptional conditions in the Apache Thrift NodeJS bindings. Specifically, when a WebSocket connection is upgraded, there is no error listener to catch uncaught exceptions. This can lead to application crashes or unexpected behavior, potentially exposing sensitive data or disrupting service availability. The issue affects all versions of Apache Thrift before 0.25.0.
How To Fix
Minimum fixed version
0.25.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement their own error handling for WebSocket connections. This can be done by adding an error listener to the WebSocket server instance. For example:
const WebSocket = require('ws');
const wsServer = new WebSocket.Server({ port: 8080 });
wsServer.on('error', (error) => {
console.error('WebSocket error:', error);
});
This code snippet ensures that any errors occurring in the WebSocket server are logged and handled appropriately.
Conclusion
In summary, CVE-2026-96294 is a significant vulnerability in the Apache Thrift NodeJS bindings that can lead to improper error handling in WebSocket connections. Users are strongly advised to upgrade to version 0.25.0 or later to mitigate this risk. Implementing temporary workarounds can help in the interim, but a permanent fix through upgrading is essential for maintaining application security.
See every vulnerability recorded for thrift →
FAQ
CVE-2026-96294 is a vulnerability in the Apache Thrift NodeJS bindings that involves improper error handling during WebSocket connections.
If your application uses Apache Thrift versions before 0.25.0, it may crash or behave unexpectedly when handling WebSocket connections, potentially leading to service disruptions.
You can implement a temporary workaround by adding error listeners to your WebSocket server to handle exceptions until you can upgrade.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, using an outdated version can expose your application to security vulnerabilities, which may lead to data breaches or service interruptions.
Related vulnerabilities
Recent vulnerabilities recorded for thrift.
