What is the CVSS score of CVE-2026-59892?

CVE-2026-59892 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of OpenTelemetry JavaScript are affected by CVE-2026-59892?

OpenTelemetry's Jaeger propagator (versions before 2.9.0) contains a denial-of-service vulnerability allowing unauthenticated remote attackers to crash Node.js services via malformed HTTP headers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-59892?

Yes, a public proof-of-concept exploit is available for CVE-2026-59892. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-59892?

Within 24 hours: Inventory all Node.js services using @opentelemetry/propagator-jaeger and current version numbers. Within 7 days: Update @opentelemetry/propagator-jaeger to version 2.9.0 across development and staging environments; validate in pre-production before production deployment. Within 30 days: Complete production rollout of version 2.9.0 and verify all services are running the patched version.

OpenTelemetry JavaScript CVE-2026-59892

EUVD-2026-42324 HIGH

Uncaught Exception (CWE-248)

2026-07-08 GitHub_M

GHSA-45rx-2jwx-cxfr

Information Disclosure Node.js Red Hat Opentelemetry Js Open Telemetry

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated single-request crash with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is process termination only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 18:02 EUVD

Analysis Generated

Jul 08, 2026 - 16:54 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

235 npm packages depend on @opentelemetry/propagator-jaeger (6 direct, 229 indirect)

Ecosystem-wide dependent count for version 2.9.0.

DescriptionCVE.org

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 1 Critical, 4 High Severity Jul 09, 2026

AnalysisAI

Denial of service in OpenTelemetry JavaScript (@opentelemetry/propagator-jaeger) before 2.9.0 allows an unauthenticated remote attacker to crash a Node.js service by sending a malformed percent-encoded uber-trace-id or uberctx-* HTTP header. The JaegerPropagator passes header values to decodeURIComponent() without catching the resulting URIError, so the uncaught exception terminates the process. No public exploit identified at time of analysis, and this is not listed in CISA KEV; the fix is version 2.9.0.

Technical ContextAI

OpenTelemetry JavaScript is the JS/Node.js implementation of the OpenTelemetry observability framework. The affected component is the Jaeger propagator, which extracts distributed-trace context from inbound HTTP requests by reading the 'uber-trace-id' header and 'uberctx-*' baggage headers. To reverse percent-encoding applied to those header values, the propagator calls the standard JavaScript decodeURIComponent() function. When given a malformed percent sequence (for example a lone '%' or '%ZZ'), decodeURIComponent() throws a URIError. Because the propagator does not wrap this call in error handling, the exception propagates as an uncaught exception. This maps to CWE-248 (Uncaught Exception): in Node.js an uncaught synchronous exception on the request path crashes the entire process, taking down every request the process was serving. The affected code path is only reached when JaegerPropagator is configured as the active propagator. Affected CPE: cpe:2.3:a:open-telemetry:opentelemetry-js:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade @opentelemetry/propagator-jaeger (and the OpenTelemetry JS packages) to version 2.9.0 or later, which adds error handling around the decodeURIComponent() call (fix commit b1c196d49d54caae59741cca0a9d57d101d7ea88). If immediate upgrade is not possible, the most direct compensating control is to stop using JaegerPropagator as the active propagator and switch to the W3C TraceContext propagator, which avoids the vulnerable code path entirely - the trade-off is loss of Jaeger-format trace context interoperability with any upstream Jaeger-instrumented services. Alternatively, place a reverse proxy or WAF in front of the service to reject or sanitize inbound uber-trace-id and uberctx-* headers containing malformed percent-encoding, accepting the trade-off of added request-path filtering and potential false positives on legitimately encoded values. Refer to the advisory at https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr and release notes at https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0.