Vulnerability Details CVE-2026-44902
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 40.0%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-44902
-
cpe:2.3:a:opentelemetry:opentelemetry/auto-instrumentations-node:*
-
cpe:2.3:a:opentelemetry:opentelemetry/exporter-prometheus:*
-
cpe:2.3:a:opentelemetry:opentelemetry/sdk-node:*