Improper Handling of Exceptional Conditions
CVE-2026-44902
Summary
A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process. @opentelemetry/auto-instrumentations-node versions prior to 0.75.0, @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node versions prior to 0.217.0 are affected.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- NONE
- HIGH
CWE-755 - Improper Handling of Exceptional Conditions
The software does not handle or incorrectly handles an exceptional condition.
References
Advisory Timeline
- Published