High severity7.5OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-59892
CVE-2026-59892
Description
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@opentelemetry/propagator-jaegernpm | < 2.9.0 | 2.9.0 |
Affected products
23- osv-coords21 versionspkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/gemini-clipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/librechatpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/langfuse-fips-2pkg:apk/chainguard/cadence-webpkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/langfuse-2
< 9.1.10-r30+ 20 more
- (no CPE)range: < 9.1.10-r30
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 9.0.8-r35
- (no CPE)range: < 9.1.10-r30
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 9.4.4-r1
- (no CPE)range: < 9.4.4-r1
- (no CPE)range: < 2.95.12-r39
- (no CPE)range: < 0.49.0-r8
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 9.3.8-r1
- (no CPE)range: < 2.95.12-r40
- (no CPE)range: < 0.8.7-r5
- (no CPE)range: < 9.0.8-r35
- (no CPE)range: < 9.0.8-r35
- (no CPE)range: < 9.2.8-r18
- (no CPE)range: < 2.95.12-r40
- (no CPE)range: < 4.0.16-r3
- (no CPE)range: < 9.2.8-r18
- (no CPE)range: < 9.3.8-r1
- (no CPE)range: < 2.95.12-r39
v2.8.0, experimental/v0.219.0, experimental/v0.218.0, …+ 1 more
- (no CPE)range: v2.8.0, experimental/v0.219.0, experimental/v0.218.0, …
- (no CPE)range: <2.9.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-45rx-2jwx-cxfrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59892ghsaADVISORY
- github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88nvdWEB
- github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0nvdWEB
- github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfrnvdWEB
News mentions
0No linked articles in our index yet.