A high-severity denial-of-service vulnerability, identified as CVE-2026-59892 with a CVSS score of 7.5, exists in the JaegerPropagator component of OpenTelemetry JavaScript. This flaw arises from an unhandled exception on a malformed header, which can terminate any Node.js process that utilizes this propagator as its active propagator. An unauthenticated remote attacker can exploit this vulnerability by sending a single HTTP request to a service with JaegerPropagator registered as the global propagator, resulting in process termination without affecting confidentiality or integrity. The affected configuration includes services using @opentelemetry/propagator-jaeger in their dependency tree and setting OTEL_PROPAGATORS to jaeger, or making direct calls to propagation.setGlobalPropagator(new JaegerPropagator). To mitigate this issue, update @opentelemetry/propagator-jaeger to 2.9.0 or later, which now ignores header values it cannot decode instead of throwing an exception.
We recommend you to update OpenTelemetry JavaScript to version 2.9.0.[/subscribe_to_unlock_form]
A high-severity denial-of-service vulnerability, identified as CVE-2026-59892 with a CVSS score of 7.5, exists in the JaegerPropagator component of OpenTelemetry JavaScript. This flaw arises from an unhandled exception on a malformed header, which can terminate any Node.js process that utilizes this propagator as its active propagator. An unauthenticated remote attacker can exploit this vulnerability by sending a single HTTP request to a service with JaegerPropagator registered as the global propagator, resulting in process termination without affecting confidentiality or integrity. The affected configuration includes services using @opentelemetry/propagator-jaeger in their dependency tree and setting OTEL_PROPAGATORS to jaeger, or making direct calls to propagation.setGlobalPropagator(new JaegerPropagator). To mitigate this issue, update @opentelemetry/propagator-jaeger to 2.9.0 or later, which now ignores header values it cannot decode instead of throwing an exception.
We recommend you to update OpenTelemetry JavaScript to version 2.9.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]