7.5
Élevée
CVE-2026-59892 OpenTelemetry JavaScript is the OpenTelemetry JavaScript client
Description
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| opentelemetry-js 2.9 | premières → < 2.9.0 | 2.9.0 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification