7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44902

CVE-2026-44902: opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44902

CVE-2026-44902:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@opentelemetry/exporter-prometheus	npm	< 0.217.0	0.217.0
@opentelemetry/sdk-node	npm	< 0.217.0	0.217.0
@opentelemetry/auto-instrumentations-node	npm	< 0.75.0	0.75.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

This vulnerability in the OpenTelemetry JS Prometheus exporter allows a remote, unauthenticated attacker to crash the Node.js process, resulting in a denial of service. The root cause is an uncaught TypeError that occurs when the built-in HTTP server attempts to parse a malformed URL.

The vulnerability lies in the _requestHandler method of the PrometheusExporter class, located in packages/opentelemetry-exporter-prometheus/src/PrometheusExporter.ts. The code calls new URL(request.url, this._baseUrl) to parse the incoming request URL. However, it does not handle cases where request.url is a malformed or invalid URL, such as "http://". In such cases, the URL constructor throws a TypeError. Because there is no try...catch block to handle this exception, it propagates up the call stack, leading to an uncaught exception that crashes the entire Node.js process.

The fix for this vulnerability involves wrapping the URL parsing logic in a try...catch block. If a TypeError is caught, the server now returns an HTTP 400 "Bad Request" response to the client instead of crashing. This ensures that malformed requests are handled gracefully without impacting the availability of the application.

An attacker can trigger this vulnerability by sending a single, specially crafted HTTP request to the Prometheus metrics endpoint (defaulting to port 9464). For example, a request with the URL http:// is sufficient to cause the crash. Since the metrics endpoint is often exposed to the network for scraping by a Prometheus server, any application using the affected versions of the OpenTelemetry JS Prometheus exporter is at risk.

Vulnerable functions

PrometheusExporter._requestHandler

packages/opentelemetry-exporter-prometheus/src/PrometheusExporter.ts

This function handles incoming HTTP requests for the Prometheus exporter. It is vulnerable because it does not handle exceptions when parsing the request URL. A malformed URL can cause a `TypeError` that crashes the process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.