{"id":"CVE-2026-59892","revision":"7f2d920ab9f74a2684b52b3a3fde7484","records":[{"revision":"7f2d920ab9f74a2684b52b3a3fde7484","observedAt":"2026-10-25T14:19:22.811+00:00","statement":{"source":"nvd","id":"CVE-2026-59892","aliases":[],"title":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allo…","description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.","state":0,"publishedAt":"2026-07-08T17:17:27.19+00:00","modifiedAt":"2026-07-10T18:56:03.583+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0","https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59892","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-248"],"productCriteria":[],"sourceDates":{"published":"2026-07-08T17:17:27.190","lastModified":"2026-07-10T18:56:03.583"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59892","identifiers":["CVE-2026-59892"]},"retained":false,"historicalAffected":[]}],"coverage":[]}