CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
A malformed HTTP request crashes the Node.js process running the OpenTelemetry JS Prometheus exporter due to missing error handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44902?
CVE-2026-44902 is a high-severity denial of service vulnerability in @opentelemetry auto-instrumentations-node, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
Weakness: CWE-755
Which versions are affected by CVE-2026-44902?
6 open source packages ship an affected version, including @opentelemetry/auto-instrumentations-node, @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
@opentelemetry/auto-instrumentations-node npm | From 0.55.0 | 0.75.0 |
@opentelemetry/auto-instrumentations-node npm | From 0.55.0 | 0.75.0 |
@opentelemetry/exporter-prometheus npm | All versions | 0.217.0 |
@opentelemetry/exporter-prometheus npm | All versions | 0.217.0 |
@opentelemetry/sdk-node npm | From 0.57.0 | 0.217.0 |
@opentelemetry/sdk-node npm | From 0.57.0 | 0.217.0 |
Products include Opentelemetry Opentelemetry\/Auto-Instrumentations-Node, Opentelemetry Opentelemetry\/Exporter-Prometheus, Opentelemetry Opentelemetry\/Sdk-Node.
How do I fix CVE-2026-44902?
Upgrade @opentelemetry/auto-instrumentations-node to 0.75.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44902 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44902 exists.
Sources
Also known as CLEANSTART-2026-KU07150, ECHO-72ea-32d7-a155, GHSA-q7rr-3cgh-j5r3, MINI-7pfw-97v3-2372, MINI-88c5-whcm-qmwg, MINI-c8h3-7xxv-c789 and 10 more.