{"ghsa_id":"GHSA-q7rr-3cgh-j5r3","cve_id":"CVE-2026-44902","url":"https://api.github.com/advisories/GHSA-q7rr-3cgh-j5r3","html_url":"https://github.com/advisories/GHSA-q7rr-3cgh-j5r3","summary":"Prometheus exporter process crash via malformed HTTP request","description":"## Summary\n\nA single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process.\n\n**You are affected by this vulnerability if either of the following apply to your application:**\n\n* you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server.\n* your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND**\n  * you use `@opentelemetry/sdk-node`\n  * you use  `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register`\n\n## Impact\n\n**Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.\n\n## Remediation\n\n### Update to the fixed version\n\nUpdate `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. \nUpdate `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later.\n\nThis release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process.\n\n```\nnpm install @opentelemetry/exporter-prometheus@latest\n```\n\n### Do Not Expose the Endpoint to Untrusted Users\n\n> [!IMPORTANT] \n> The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution.\n\nIf updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:\n\n* **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces\n\n* **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts\n\n* **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter\n\n## Details\n\nIn `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `\"http://\"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.\n\nThe Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port.\n\n## Proof of Concept\n\nStart any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet:\n\n```\necho -ne 'GET http:// HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' | nc localhost 9464\n```\n\nThe process crashes immediately with:\n\n```\nTypeError: Invalid URL\n    at new URL (...)\n    at PrometheusExporter._requestHandler (...)\n```","type":"reviewed","severity":"high","repository_advisory_url":"https://api.github.com/repos/open-telemetry/opentelemetry-js/security-advisories/GHSA-q7rr-3cgh-j5r3","source_code_location":"https://github.com/open-telemetry/opentelemetry-js","identifiers":[{"value":"GHSA-q7rr-3cgh-j5r3","type":"GHSA"},{"value":"CVE-2026-44902","type":"CVE"}],"references":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3","https://nvd.nist.gov/vuln/detail/CVE-2026-44902","https://github.com/advisories/GHSA-q7rr-3cgh-j5r3"],"published_at":"2026-05-11T14:42:10Z","updated_at":"2026-06-08T23:42:16Z","github_reviewed_at":"2026-05-11T14:42:10Z","nvd_published_at":"2026-05-27T15:16:29Z","withdrawn_at":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@opentelemetry/exporter-prometheus"},"vulnerable_version_range":"< 0.217.0","first_patched_version":"0.217.0","vulnerable_functions":[]},{"package":{"ecosystem":"npm","name":"@opentelemetry/sdk-node"},"vulnerable_version_range":"< 0.217.0","first_patched_version":"0.217.0","vulnerable_functions":[]},{"package":{"ecosystem":"npm","name":"@opentelemetry/auto-instrumentations-node"},"vulnerable_version_range":"< 0.75.0","first_patched_version":"0.75.0","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":0.0}},"cwes":[{"cwe_id":"CWE-755","name":"Improper Handling of Exceptional Conditions"}],"credits":[{"user":{"login":"homanp","id":2464556,"node_id":"MDQ6VXNlcjI0NjQ1NTY=","avatar_url":"https://avatars.githubusercontent.com/u/2464556?v=4","gravatar_id":"","url":"https://api.github.com/users/homanp","html_url":"https://github.com/homanp","followers_url":"https://api.github.com/users/homanp/followers","following_url":"https://api.github.com/users/homanp/following{/other_user}","gists_url":"https://api.github.com/users/homanp/gists{/gist_id}","starred_url":"https://api.github.com/users/homanp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/homanp/subscriptions","organizations_url":"https://api.github.com/users/homanp/orgs","repos_url":"https://api.github.com/users/homanp/repos","events_url":"https://api.github.com/users/homanp/events{/privacy}","received_events_url":"https://api.github.com/users/homanp/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter"},{"user":{"login":"pichlermarc","id":22105064,"node_id":"MDQ6VXNlcjIyMTA1MDY0","avatar_url":"https://avatars.githubusercontent.com/u/22105064?v=4","gravatar_id":"","url":"https://api.github.com/users/pichlermarc","html_url":"https://github.com/pichlermarc","followers_url":"https://api.github.com/users/pichlermarc/followers","following_url":"https://api.github.com/users/pichlermarc/following{/other_user}","gists_url":"https://api.github.com/users/pichlermarc/gists{/gist_id}","starred_url":"https://api.github.com/users/pichlermarc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pichlermarc/subscriptions","organizations_url":"https://api.github.com/users/pichlermarc/orgs","repos_url":"https://api.github.com/users/pichlermarc/repos","events_url":"https://api.github.com/users/pichlermarc/events{/privacy}","received_events_url":"https://api.github.com/users/pichlermarc/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"remediation_verifier"},{"user":{"login":"arminru","id":7052238,"node_id":"MDQ6VXNlcjcwNTIyMzg=","avatar_url":"https://avatars.githubusercontent.com/u/7052238?v=4","gravatar_id":"","url":"https://api.github.com/users/arminru","html_url":"https://github.com/arminru","followers_url":"https://api.github.com/users/arminru/followers","following_url":"https://api.github.com/users/arminru/following{/other_user}","gists_url":"https://api.github.com/users/arminru/gists{/gist_id}","starred_url":"https://api.github.com/users/arminru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arminru/subscriptions","organizations_url":"https://api.github.com/users/arminru/orgs","repos_url":"https://api.github.com/users/arminru/repos","events_url":"https://api.github.com/users/arminru/events{/privacy}","received_events_url":"https://api.github.com/users/arminru/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"coordinator"}],"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"epss":{"percentage":0.00472,"percentile":0.38816}}