Jens Geyer created THRIFT-6090:
----------------------------------
Summary: Bound receive size and amortize buffer growth in Node.js
transports
Key: THRIFT-6090
URL: https://issues.apache.org/jira/browse/THRIFT-6090
Project: Thrift
Issue Type: Bug
Components: Node.js - Library
Reporter: Jens Geyer
Fix For: 0.24.0
TBufferedTransport and TFramedTransport's receiver functions in the Node.js
library grew their receive buffer without an overall size cap and without
amortized (geometric) growth, so a server accepting data from an
unauthenticated peer had no way to bound per-connection memory use or avoid
quadratic-time buffer growth on many small appends.
Fixed by adding geometric buffer growth plus an optional maxLength parameter to
both receivers, with server.js/web_server.js applying a default cap and
surfacing an over-cap condition via the stream error path.
*Affects:* Node.js TBufferedTransport and TFramedTransport, present in 0.23.0;
fixed in 0.24.0
*Fixed by:* commit 4ff326d9a
*CWE-407 / CWE-770:* Inefficient Algorithmic Complexity / Allocation of
Resources Without Limits or Throttling
*CVSS 4.0:* approx. 8.7 High
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}}) -- note
this is not an amplification attack (the peer must transmit the full payload);
actual severity depends on deployment.
*Reported by:* Song Jihoon
*CVE:* CVE-2026-55968
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
