OpenTelemetry JavaScript CVE-2026-59892

Exploitation requires that the target Node.js service uses OpenTelemetry JS's JaegerPropagator as its active/configured propagator and exposes an HTTP endpoint that parses incoming trace-context headers - this is the concrete, required precondition (the code path is not reached under the default non-Jaeger propagator configuration). Given that condition, no authentication, privileges, or user interaction are needed (AV:N/AC:L/PR:N/UI:N): the attacker simply sends a malformed percent-encoded value in the uber-trace-id or any uberctx-* header. The primary limiting factor is the non-default Jaeger propagator requirement; a secondary mitigant is any front-end proxy that normalizes or rejects malformed header encoding before it reaches the Node.js process.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated request with no user interaction yields a pure availability impact (C:N/I:N) - a process crash with no data exposure or integrity loss. Note the input Tags label this 'Information Disclosure,' which conflicts with the CVSS impact and the described crash behavior; treat the tag as inaccurate - this is a denial-of-service issue, not information disclosure. No EPSS score, KEV entry, SSVC decision, or POC was provided in the intelligence, so real-world exploitation likelihood cannot be quantified from the data. The practical risk hinges on one factor the raw CVSS does not capture: the JaegerPropagator must be the active propagator, which is an opt-in, non-default configuration (the OpenTelemetry default is typically W3C TraceContext). For services that do run Jaeger propagation, the attack is trivial and repeatable, making it a credible availability threat; for the majority using other propagators, real risk is negligible. Verify propagator configuration before prioritizing.

An attacker identifies a public HTTP endpoint fronted by a Node.js service that uses the Jaeger propagator to accept distributed-trace headers. They send a single request with a header such as 'uber-trace-id: %' (an invalid percent sequence), causing decodeURIComponent() to throw an uncaught URIError that crashes the Node.js process and drops all in-flight requests. Given AV:N/AC:L with no authentication or user interaction, the attacker can script repeated requests to keep the service continuously offline; no POC is currently published.