CVE-2026-44902: open-telemetry opentelemetry-js, логическа грешка

Описание

Оригинално описание

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

Засегнати продукти

• open-telemetry opentelemetry-js: < 0.217.0
• @opentelemetry exporter-prometheus: < 0.217.0
• @opentelemetry sdk-node: < 0.217.0
• @opentelemetry auto-instrumentations-node: < 0.75.0

Вид слабост

• CWE-755 Improper Handling of Exceptional Conditions

История

Други уязвимости в open-telemetry opentelemetry-js

• 7.5CVE-2026-59892
• 5.3CVE-2026-54285

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-44902
• https://nvd.nist.gov/vuln/detail/CVE-2026-44902
• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3