CVE-2026-44902: open-telemetry opentelemetry-js
CVSS: 7.5v3.1HighAnalyzed
AliasesCGA-8v8j-r7h6-v4pqCGA-925j-5fg3-h247CGA-9586-g2q5-833qCGA-p5g6-8gc2-hhf4GHSA-q7rr-3cgh-j5r3CGA-22f6-x7h2-6x9pCGA-27cj-gv6x-jrc5CGA-2frq-5625-f4w8CGA-2xrm-6699-xmv2CGA-352j-h4p5-vcfxCGA-36m8-368q-g3p5CGA-37c3-4x37-2cfpCGA-3fc8-qrjh-w6r4CGA-3gf3-8m8c-cwqwCGA-3j2h-928j-5wmhCGA-3j7j-r3w9-qhxvCGA-44hv-9p7f-c692CGA-4pq8-j4f3-hq5pCGA-4xf2-xw62-4382CGA-5c7v-6rxm-mpqrCGA-5jpx-cm48-97ffCGA-63rr-342r-4wcrCGA-6g45-8wc3-rjc8CGA-6p3x-98c2-8c5xCGA-73xq-6v32-ww9mCGA-7737-32j7-xjr4CGA-7mgm-697p-pw3wCGA-7p8x-4gj7-c835CGA-7q8q-9885-5cmrCGA-8455-5pcm-8xc6CGA-85gg-qjp5-98f4CGA-8vhg-c26v-2m3fCGA-8xp3-pmxg-cm8rCGA-942c-m32m-93p9CGA-986r-jmg4-jpggCGA-98cq-qhcf-68h5CGA-9948-2hfq-p7qqCGA-9jgw-r8rr-vfcgCGA-9vvw-79pj-85vhCGA-9w4r-phg6-c3vgCGA-c75q-385h-5w9jCGA-c7m4-qfrm-xq5wCGA-cf4j-xrfw-63f5CGA-crqh-93w8-hhf5CGA-cv5v-rqqm-76xjCGA-cwcp-m4fm-5hr2CGA-f2jg-r7gc-jvcrCGA-f6m2-hmq3-6w3qCGA-fcw9-82g5-9mjgCGA-fgcp-57qg-7h4xCGA-fp86-h536-6hggCGA-fqwj-vgw7-7jcvCGA-frv4-2gmr-3xjfCGA-g9xf-pq33-p4g5CGA-ghf6-qrwv-jfj6CGA-gmqh-82p9-22fmCGA-h723-wr8v-hv48CGA-h8q3-qqr5-x7cxCGA-hcw5-g8qp-g927CGA-hjcx-wfhx-m683CGA-hrq7-fhqw-rp2qCGA-hx25-v56r-vj6jCGA-j282-rx48-6hh6CGA-j9ff-wrv2-62jfCGA-jjjj-v2cr-66gjCGA-jq9p-7f65-96x8CGA-jxw4-7qrq-p26vCGA-m2f4-vwv3-crq7CGA-mc56-vph9-fw36CGA-mp2x-57rg-rjvhCGA-mp4f-cc3h-3hfvCGA-mwj3-h2j2-867hCGA-mwxr-xj26-c4wwCGA-p2wh-v86g-gjq7CGA-p9p7-59j2-ww73CGA-phc4-fvqg-f44hCGA-pj4p-p969-28vmCGA-qf6m-m5vf-c8xwCGA-qfc2-8w93-4crcCGA-qg2c-q4f3-7pp3CGA-r2g6-68h4-mgmvCGA-rc4r-8cf8-gq7wCGA-rmv9-r4c3-3xm9CGA-rqwc-87mq-xvh7CGA-rr94-m633-gf6vCGA-vhr4-5w6f-w366CGA-vr5p-cwxh-3rw2CGA-w3gq-m74p-27rpCGA-w8j5-chwc-rpg5CGA-w9r7-xq3q-pp8pCGA-wcrr-97cq-3vphCGA-wppp-4qrw-759rCGA-wv7g-pvqf-2qw4CGA-wx5v-3vvr-965hCGA-wxf2-xqm4-45vhCGA-x35r-q6wc-5v8qCGA-xq37-6qfm-j9v2
Published 27-05-2026Last modified 28-05-2026
Vulnerability summary
CVE-2026-44902 is a high (CVSS 7.5) vulnerability in open-telemetry opentelemetry-js. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.49%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-05-2026PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.01 pp
From 0.47% on 20-09-2026
20-09-202620-10-2026
EPSS score0.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpentelemetry Js
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard29 products
- cadence-web< 4.0.16-r0
- gemini-cli< 0.41.2-r0
- kibana-8.17< 8.17.10-r23
- kibana-8.17-bitnami< 8.17.10-r23
- kibana-8.17-iamguarded< 8.17.10-r23
@opentelemetry6 products
- auto-instrumentations-node< 0.75.0 | ≥ 0.55.0, < 0.75.0
- exporter-prometheus< 0.217.0
- sdk-node< 0.217.0 | ≥ 0.57.0, < 0.217.0
- auto-instrumentations-node< 0.75.0
- exporter-prometheus< 0.217.0
Opentelemetry3 products
- opentelemetry\/auto-instrumentations-node< 0.75.0
- opentelemetry\/exporter-prometheus< 0.217.0
- opentelemetry\/sdk-node< 0.217.0
Wolfi2 products
- langfuse-3< 3.174.1-r0
- langfuse-3-worker< 3.174.1-r0
Open-telemetry1 product
- opentelemetry-js< 0.217.0
5 vendors · 41 products
References
7 links- github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3X Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
