CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
An unauthenticated remote attacker can crash a Node.js process by sending malformed HTTP headers to applications using the JaegerPropagator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59892?
CVE-2026-59892 is a high-severity denial of service vulnerability in open-telemetry opentelemetry-js, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
Weakness: CWE-248
Which versions are affected by CVE-2026-59892?
2 open source packages ship an affected version, including @opentelemetry/propagator-jaeger.
| Package | Affected | Fixed in |
|---|---|---|
@opentelemetry/propagator-jaeger npm | All versions | 2.9.0 |
@opentelemetry/propagator-jaeger npm | All versions | 2.9.0 |
How do I fix CVE-2026-59892?
Upgrade @opentelemetry/propagator-jaeger to 2.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59892 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59892 exists.
Sources
Also known as CLEANSTART-2026-SG26208, CLSA-2026-1791460637, CLSA-2026-1793272717, CLSA-2026-1793272846, CLSA-2026-1793275058, ECHO-52e8-4aea-0197 and 17 more.