An uncontrolled recursion vulnerability in Apache Thrift Node.js bindings allows unauthenticated attackers to cause a denial of service via resource exhaustion.

This vulnerability is an uncontrolled recursion (CWE-674) issue within the Node.js bindings that can be triggered by an unauthenticated attacker, leading to significant service instability or crash.

The successful exploitation of this vulnerability results in a denial of service, which can cause system downtime and interrupt critical business operations. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to availability, as it requires no authentication to trigger and can be exploited remotely.

Immediate Action: Update the Apache Thrift Node.js package to version 0.23.0 or later to resolve the recursion flaw.

Proactive Monitoring: Monitor application logs and server resource utilization for sudden spikes in memory or CPU usage that may indicate recursion-based crash attempts.

Compensating Controls: Implement rate limiting and input validation at the network edge or via a Web Application Firewall to restrict malformed requests that could trigger the recursive call chain.

Public Exploit Available: Unknown

This vulnerability represents a high risk to the availability of services utilizing Apache Thrift Node.js. Administrators should prioritize updating to version 0.23.0 immediately to eliminate the underlying recursive logic error and prevent potential service disruption.