AIKIDO-2026-10700

TL;DR

The Node.js library exposes deserialization helpers that call skip() while advancing over unknown Thrift fields. For hostile messages, that path could recurse without an effective bound tied to untrusted structure. Processing such input could exhaust the JavaScript call stack and terminate the process handling the connection. The corrected behavior constrains that traversal so depth cannot grow without bound for attacker-controlled payloads.