Skip to content
fr Sign in
7.5 High

CVE-2026-59892 OpenTelemetry JavaScript is the OpenTelemetry JavaScript client

Description

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-js 2.9 earliest → < 2.9.0 2.9.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of opentelemetry-js

The 3 CVEs of opentelemetry-js →
CVE-2026-54285 opentelemetry-js is the OpenTelemetry JavaScript Client 5.3 Medium CVE-2026-44902 opentelemetry-js is the OpenTelemetry JavaScript Client 7.5 High
Track this CVE