{"id":"GHSA-q7rr-3cgh-j5r3","revision":null,"records":[{"revision":"0875e9f5d2ea446fbe49c7e4b8c2eea6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44902","aliases":[],"title":"opentelemetry-js: Prometheus exporter process crash via malformed HTTP request","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","state":0,"publishedAt":"2026-05-27T14:49:04.94+00:00","modifiedAt":"2026-05-28T15:26:13.701+00:00","affected":[{"ecosystem":"Vendor product","name":"opentelemetry-js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"open-telemetry\",\n                    \"product\": \"opentelemetry-js\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.217.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"exporter-prometheus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@opentelemetry\",\n                    \"product\": \"exporter-prometheus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.217.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"sdk-node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@opentelemetry\",\n                    \"product\": \"sdk-node\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.217.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"auto-instrumentations-node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@opentelemetry\",\n                    \"product\": \"auto-instrumentations-node\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.75.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44902","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44902","identifiers":["CVE-2026-44902"]},"retained":false,"historicalAffected":[]},{"revision":"ea3a201d7ba04bc88c403ffe014bef3c","observedAt":"2026-11-07T10:32:35.977+00:00","statement":{"source":"euvd","id":"EUVD-2026-32538","aliases":["CVE-2026-44902","GHSA-q7rr-3cgh-j5r3"],"title":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no erro…","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32538","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 27, 2026, 2:49:04 PM","dateUpdated":"May 28, 2026, 3:26:13 PM"},"relatedAdvisories":[{"id":"RHSA-2026:51162","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-44902","CVE-2026-45740","CVE-2026-48068","CVE-2026-48801","CVE-2026-59873","CVE-2026-59877"]},{"id":"RHSA-2026:41929","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.","vulnerabilityIds":["CVE-2026-6734","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-13676","CVE-2026-42504","CVE-2026-44902","CVE-2026-45740"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32538","identifiers":["EUVD-2026-32538","CVE-2026-44902","GHSA-q7rr-3cgh-j5r3"]},"retained":false,"historicalAffected":[]},{"revision":"f327d3bade30404c9206b10b46f0e218","observedAt":"2026-10-25T10:17:27.754+00:00","statement":{"source":"nvd","id":"CVE-2026-44902","aliases":[],"title":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no erro…","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","state":0,"publishedAt":"2026-05-27T15:16:29.313+00:00","modifiedAt":"2026-08-27T16:16:49.81+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44902","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-755"],"productCriteria":["cpe:2.3:a:opentelemetry:opentelemetry\\/auto-instrumentations-node:*:*:*:*:*:node.js:*:*","cpe:2.3:a:opentelemetry:opentelemetry\\/exporter-prometheus:*:*:*:*:*:node.js:*:*","cpe:2.3:a:opentelemetry:opentelemetry\\/sdk-node:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-05-27T15:16:29.313","lastModified":"2026-08-27T16:16:49.810"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44902","identifiers":["CVE-2026-44902"]},"retained":false,"historicalAffected":[]},{"revision":"6910367d1f3048a4a4db78aa054af398","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q7rr-3cgh-j5r3","aliases":["CVE-2026-44902"],"title":"Prometheus exporter process crash via malformed HTTP request","description":"## Summary\n\nA single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process.\n\n**You are affected by this vulnerability if either of the following apply to your application:**\n\n* you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server.\n* your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND**\n  * you use `@opentelemetry/sdk-node`\n  * you use  `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register`\n\n## Impact\n\n**Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.\n\n## Remediation\n\n### Update to the fixed version\n\nUpdate `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. \nUpdate `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later.\n\nThis release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process.\n\n```\nnpm install @opentelemetry/exporter-prometheus@latest\n```\n\n### Do Not Expose the Endpoint to Untrusted Users\n\n> [!IMPORTANT] \n> The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution.\n\nIf updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:\n\n* **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces\n\n* **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts\n\n* **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter\n\n## Details\n\nIn `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `\"http://\"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.\n\nThe Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port.\n\n## Proof of Concept\n\nStart any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet:\n\n```\necho -ne 'GET http:// HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' | nc localhost 9464\n```\n\nThe process crashes immediately with:\n\n```\nTypeError: Invalid URL\n    at new URL (...)\n    at PrometheusExporter._requestHandler (...)\n```","state":0,"publishedAt":"2026-05-11T14:42:10+00:00","modifiedAt":"2026-10-19T19:45:04.4207497+00:00","affected":[{"ecosystem":"npm","name":"@opentelemetry/exporter-prometheus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.217.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@opentelemetry/sdk-node","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.57.0"},{"kind":"fixed","version":"0.217.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@opentelemetry/auto-instrumentations-node","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.55.0"},{"kind":"fixed","version":"0.75.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3","https://nvd.nist.gov/vuln/detail/CVE-2026-44902","https://github.com/github/advisory-database/pull/10226","https://github.com/open-telemetry/opentelemetry-js","https://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95","https://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55"],"sourceUrl":"https://github.com/advisories/GHSA-q7rr-3cgh-j5r3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q7rr-3cgh-j5r3","identifiers":["GHSA-q7rr-3cgh-j5r3","CVE-2026-44902"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T19:47:20.1649891+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T19:47:20.1649891+00:00","lastSuccessAt":"2026-11-08T19:47:20.3943637+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.3943658+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5ed072895efd00dfc9298eaa4ea0dc8e51b29da4254bc61a9f28835ec1fa6ea6","complete":true,"records":421260,"lastAttemptAt":"2026-11-08T19:47:19.7023073+00:00","lastSuccessAt":"2026-11-08T19:47:19.6080199+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.7023073+00:00","snapshotPublishedAt":"2026-11-08T19:27:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f1b70ba09149408c9b3f93f80725b8b9","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T19:48:04.0257169+00:00","lastSuccessAt":"2026-11-08T19:48:04.022+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:48:04.022+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T19:47:20.1649891+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T19:47:20.1649891+00:00","lastSuccessAt":"2026-11-08T19:47:20.3951142+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.3951146+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3b79c659b4ac42b2801e63ff6ff3a882","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T19:47:46.1695591+00:00","lastSuccessAt":"2026-11-08T19:47:46.166+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:46.166+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13206,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T19:47:20.0165357+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.0165357+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T19:47:19.7560084+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.7560084+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T19:47:20.1181272+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.1181272+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T19:47:19.9161497+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.9161497+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}