Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-44902

opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

open-telemetry opentelemetry-js

  • < 0.217.0affected

@opentelemetry exporter-prometheus

  • < 0.217.0affected

@opentelemetry sdk-node

  • < 0.217.0affected

@opentelemetry auto-instrumentations-node

  • < 0.75.0affected

References