VYPR
← All advisories
High severity7.5GHSA Advisory· Published May 27, 2026· Updated May 29, 2026

CVE-2026-44902

CVE-2026-44902

Description

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@opentelemetry/exporter-prometheusnpm
< 0.217.00.217.0
@opentelemetry/sdk-nodenpm
< 0.217.00.217.0
@opentelemetry/auto-instrumentations-nodenpm
< 0.75.00.75.0

Affected products

31

Patches

Vulnerability mechanics

References

3

News mentions

1