CVE-2026-44902 Details
Description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
A denial-of-service vulnerability has been identified in the OpenTelemetry JavaScript Client, specifically in versions prior to 0.217.0 of the Prometheus exporter. The issue arises because the metrics endpoint, which listens on 0.0.0.0:9464 by default, lacks proper error handling for URL parsing. As a result, a single malformed HTTP request can cause an uncaught TypeError that crashes any Node.js process using this exporter. This vulnerability is particularly concerning because the metrics endpoint is unauthenticated and accessible by any network client that can reach the metrics port.
Users can update the OpenTelemetry Prometheus exporter and Node.js SDK to version 0.217.0 or later. Additionally, for those using the OpenTelemetry auto-instrumentations for Node.js, version 0.75.0 or later should be installed. If an immediate update is not possible, access to the metrics endpoint should be restricted from untrusted or unauthenticated network clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry/auto-instrumentations-node | < 0.75.0 |
CPE
Remediation
| |
| opentelemetry opentelemetry/exporter-prometheus | < 0.217.0 |
CPE
Remediation
| |
| opentelemetry opentelemetry/sdk-node | < 0.217.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 27, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |