p PatchFirst

PatchFirst · Latest vulnerabilities

@opentelemetry/propagator-jaeger vulnerabilities

Vulnerabilities published for @opentelemetry/propagator-jaeger in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-59892

    High · CVSS 7.5EPSS 0.56%Fix available

    OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

    OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

    @opentelemetry/propagator-jaegerNode.js
    • Update to 2.9.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →