{"id":"EUVD-2026-32538","revision":"64352a4c1f4b401fa8451d09d8c223b5","records":[{"revision":"64352a4c1f4b401fa8451d09d8c223b5","observedAt":"2026-11-05T09:57:50.442+00:00","statement":{"source":"euvd","id":"EUVD-2026-32538","aliases":["CVE-2026-44902","GHSA-q7rr-3cgh-j5r3"],"title":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no erro…","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32538","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 27, 2026, 2:49:04 PM","dateUpdated":"May 28, 2026, 3:26:13 PM"},"relatedAdvisories":[{"id":"RHSA-2026:51162","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-44902","CVE-2026-45740","CVE-2026-48068","CVE-2026-48801","CVE-2026-59873","CVE-2026-59877"]},{"id":"RHSA-2026:41929","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.","vulnerabilityIds":["CVE-2026-6734","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-13676","CVE-2026-42504","CVE-2026-44902","CVE-2026-45740"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32538","identifiers":["EUVD-2026-32538","CVE-2026-44902","GHSA-q7rr-3cgh-j5r3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}