AIKIDO-2026-185433

TL;DR

The Node.js server transport receivers in the thrift package accumulate incoming bytes without enforcing a maximum message or frame size and without rejecting negative frame sizes. TFramedTransport.receiver reads an attacker-controlled 32-bit frame length and keeps concatenating the residual buffer on every packet, so a remote peer can force the server to buffer unbounded data and repeatedly recopy the growing buffer. This lets an unauthenticated client exhaust memory and CPU and take down a Node.js Thrift server. The fix applies a default receive limit consistent with the maxMessageSize/maxFrameSize used by other Thrift libraries, rejects oversized and negative frames through the stream error path, and grows the receive buffer geometrically.