High, CVSS 7.5npmAmendedPublished
OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header
CVE-2026-59892 · GHSA-45rx-2jwx-cxfr
- Affected
- npm @opentelemetry/propagator-jaeger < 2.9.0
- Fixed in
- 2.9.0· Vendor fix available
- Issue
- @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %) in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any Node.js process that uses JaegerPropagator as its active propagator. Impact Denial of Service: Any unauthenticated remote attacker who can send an HTTP request to a service that has JaegerPropagator registered as the global propagator (e.g. via OTELPROPAGATORS=jaeger or propagation.setGlobalPropagator(new JaegerPropagator())) can terminate the process with a single request. Confidentiality and integrity are not affected. Am I affected? This issue affects only a specific, opt-in configuration. If you use OpenTelemetry's default propagators (W3C TraceContext and Baggage), you are not affected. You are affected only if you have registered JaegerPropagator as the active propagator. Check…
Recommended action: Upgrade to 2.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.