high7.5
CVE-2026-44902
Prometheus exporter process crash via malformed HTTP request
Impact
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @opentelemetry/exporter-prometheus | < 0.217.0 | 0.217.0 |
| npm | @opentelemetry/sdk-node | >= 0.57.0, < 0.217.0 | 0.217.0 |
| npm | @opentelemetry/auto-instrumentations-node | >= 0.55.0, < 0.75.0 | 0.75.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opentelemetry | Opentelemetry\/Auto-Instrumentations-Node | before 0.75.0 |
| Opentelemetry | Opentelemetry\/Exporter-Prometheus | before 0.217.0 |
| Opentelemetry | Opentelemetry\/Sdk-Node | before 0.217.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-q7rr-3cgh-j5r3
- https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3
- https://nvd.nist.gov/vuln/detail/CVE-2026-44902
- https://github.com/github/advisory-database/pull/10226
- https://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95
- https://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55