Skip to content
OpenAdvisories

Product · open-telemetry

opentelemetry-js

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-59892

    OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

    OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthentic…

    open-telemetry opentelemetry-js @opentelemetry/propagator-jaeger npm
  • High 7.5
    CVE-2026-44902

    opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

    opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around U…

    open-telemetry opentelemetry-js exporter-prometheus auto-instrumentations-node Wolfi npm