{"schemaVersion":3,"id":"CVE-2026-59892","aliases":["GHSA-45rx-2jwx-cxfr","CGA-2fmx-96w2-hvcv","CGA-2r55-jf2r-2648","CGA-37r2-383r-q9wv","CGA-4ccf-f22x-354x","CGA-4mw5-mg93-7whm","CGA-5527-f4mc-h9g9","CGA-55h2-gc4r-x6c2","CGA-5cfg-78rf-36f5","CGA-5vch-q8fq-xvjj","CGA-6r38-fhx7-984j","CGA-6w6c-6x7g-gvxm","CGA-7f92-x642-82pm","CGA-7wrv-83fh-hcrq","CGA-8933-r6pm-7632","CGA-96f9-38hj-qwhc","CGA-9f6j-6r5r-5wc4","CGA-9pr5-r9rm-3cwf","CGA-9vhq-2m5x-w4j4","CGA-c4rh-h2mj-rcxc","CGA-c87r-6p7x-xqrp","CGA-c8xg-cvg5-mm73","CGA-fm8w-x226-3x2x","CGA-g7rg-pvvv-w99j","CGA-gj93-rqcj-r4h8","CGA-gpw6-55vh-hhqq","CGA-gw3f-x332-3rvx","CGA-hfww-rq9j-43jm","CGA-hx87-35vc-8234","CGA-j4wh-xg9c-2cp4","CGA-j9v7-9rmh-gw7w","CGA-jhhx-cc6h-6g72","CGA-jmhc-jcjw-ghgj","CGA-mvhc-7r22-qvqh","CGA-pc3v-fc5h-qqp7","CGA-pjxx-qxmq-qqhr","CGA-rx3c-4ccm-rrc3","CGA-v489-9h6q-ff25","CGA-v592-96wj-8hxj","CGA-v59p-6w35-73qp","CGA-vx34-qx35-q9jh","CGA-vxff-v7gj-r653","CGA-w7p6-jhj7-gc2p","CGA-x299-9hcr-f66g","CGA-x4pr-93mr-34xw"],"status":"published","duplicateOf":null,"title":null,"description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.","dates":{"published":"2026-07-08T16:03:58.439Z","modified":"2026-07-08T19:41:27.498Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00784,"percentile":0.55317,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00784},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00784,"percentile":0.55317}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00784,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00784,"percentile":0.55317}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-248","name":"Uncaught Exception","description":"An exception is thrown from a function, but it is not caught.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/248.html"}],"affected":[{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.16-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.16-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.49.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.49.0-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.18-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.18-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.18-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.18-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.18-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.18-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.8-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.8-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.8-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.8-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2","name":"langfuse-2","label":"langfuse-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2","purlType":"apk","versions":[{"text":"< 2.95.12-r39","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r39","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r39","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r39","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2","name":"langfuse-fips-2","label":"langfuse-fips-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2","purlType":"apk","versions":[{"text":"< 2.95.12-r40","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r40","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r40","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r40","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r5","eol":null,"hubHref":null},{"vendor":"@opentelemetry","product":"propagator-jaeger","name":"@opentelemetry/propagator-jaeger","label":"propagator-jaeger","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@opentelemetry/propagator-jaeger","purlType":"npm","versions":[{"text":"< 2.9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0","eol":null,"hubHref":null},{"vendor":"open-telemetry","product":"opentelemetry-js","name":"opentelemetry-js","label":"opentelemetry-js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0","eol":null,"hubHref":"/vendor/open-telemetry/opentelemetry-js"}],"affectedCount":23,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr","label":"github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","label":"github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0","label":"github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59892","label":"nvd.nist.gov/vuln/detail/CVE-2026-59892","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-js","label":"github.com/open-telemetry/opentelemetry-js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59892.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59892.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-35JQ-PJQX-WHJR"]},"timeline":[{"kind":"published","date":"2026-07-08T16:03:58.439Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T19:41:27.498Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T00:30:13.884Z","stale":false,"partial":false}}