opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

published 2026-05-11 5 mo ago modified 2026-10-19 20 d ago also GHSA-q7rr-3cgh-j5r3 , EUVD-2026-32538

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

Patch / fix

fixed in 6

npm @opentelemetry/exporter-prometheus 0.217.0
npm @opentelemetry/sdk-node 0.217.0
npm @opentelemetry/auto-instrumentations-node 0.75.0
opentelemetry opentelemetry/auto-instrumentations-node 0.75.0
opentelemetry opentelemetry/exporter-prometheus 0.217.0
opentelemetry opentelemetry/sdk-node 0.217.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44902 updated 2026-08-06 cvss 7.5

opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request

Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/bootc-automation-portal-rhel9 1786006573
fixed: vendor fix RHSA-2026:51162
Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1784210921
fixed: vendor fix RHSA-2026:41929
Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1784210575, rhdh/rhdh-operator-bundle 1784215493
not affected: vulnerable code not present
Red Hat Hardened Images nodejs20, nodejs22, nodejs24, nodejs25, nodejs26
not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-05-28)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	@opentelemetry/exporter-prometheus	<0.217.0	0.217.0
npm	@opentelemetry/sdk-node	>=0.57.0, <0.217.0	0.217.0
npm	@opentelemetry/auto-instrumentations-node	>=0.55.0, <0.75.0	0.75.0

Affected products

open-telemetry opentelemetry-js
@opentelemetry exporter-prometheus
@opentelemetry sdk-node
@opentelemetry auto-instrumentations-node

Classification

Weakness

CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary