CVE-2026-44902 Overview
CVE-2026-44902 affects the OpenTelemetry JavaScript Client (opentelemetry-js) in versions prior to 0.217.0. The Prometheus exporter exposes a metrics endpoint on 0.0.0.0:9464 by default. A single malformed HTTP request crashes the entire Node.js process hosting the exporter. The flaw resides in unhandled URL parsing logic, which throws an uncaught TypeError when the request URI is invalid. Any unauthenticated attacker with network access to the metrics port can terminate the process remotely. The maintainers fixed the issue in release 0.217.0.
Critical Impact
A single unauthenticated HTTP request containing a malformed URI crashes any Node.js process running the vulnerable OpenTelemetry JS Prometheus exporter, producing a remote denial-of-service condition.
Affected Products
- OpenTelemetry JavaScript Client (opentelemetry-js) Prometheus exporter, versions prior to 0.217.0
- Node.js applications instrumented with the affected @opentelemetry/exporter-prometheus package
- Services exposing the default Prometheus metrics endpoint on port 9464
Discovery Timeline
- 2026-05-27 - CVE-2026-44902 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44902
Vulnerability Analysis
The OpenTelemetry JS Prometheus exporter starts an HTTP server that responds to scrape requests from Prometheus collectors. Incoming requests are parsed to extract the requested path before metrics are serialized. The exporter invokes URL parsing without wrapping the call in error-handling logic. When the parser encounters a syntactically invalid URI, it raises a TypeError. Because no upstream try/catch block or error event handler exists, the exception propagates to the Node.js event loop and terminates the process.
The weakness is classified as [CWE-755]: Improper Handling of Exceptional Conditions. Exploitation requires no authentication, no user interaction, and only network reachability to the metrics port. The result is a reliable remote denial of service against any Node.js process that imports the vulnerable exporter.
Root Cause
The root cause is missing exception handling around URL parsing in the Prometheus exporter's HTTP request handler. JavaScript's URL constructor throws on malformed input rather than returning a sentinel value. Without defensive handling, the uncaught exception escalates from a request-scoped error into a process-wide fault, violating the isolation expected between individual HTTP requests.
Attack Vector
An attacker sends a single HTTP request containing an invalid request-URI to the exposed metrics endpoint (default 0.0.0.0:9464). The malformed URI triggers the TypeError during parsing, and the Node.js process exits. Because the metrics endpoint binds to all interfaces by default, any host that can route to the service can carry out the attack. Repeating the request after a process restart causes a persistent outage of the host application, not only its telemetry surface.
Detection Methods for CVE-2026-44902
Indicators of Compromise
- Unexpected Node.js process exits with stack traces referencing URL parsing or an uncaught TypeError originating in @opentelemetry/exporter-prometheus.
- HTTP access logs showing requests to :9464 with malformed request lines or non-ASCII URI characters preceding a process crash.
- Loss of Prometheus scrape data correlated with application restarts initiated by process supervisors such as systemd, pm2, or Kubernetes liveness probes.
Detection Strategies
- Inventory deployed Node.js services and identify any importing @opentelemetry/exporter-prometheus at a version lower than 0.217.0.
- Alert on repeated container restarts or pod CrashLoopBackOff states in workloads that expose port 9464.
- Inspect application stderr for stack traces containing TypeError raised from URL parsing inside the exporter request handler.
Monitoring Recommendations
- Forward Node.js stdout and stderr to a centralized logging pipeline to capture crash traces in real time.
- Track the ratio of HTTP 400-class responses and abrupt connection resets on the metrics endpoint as a leading indicator of probing.
- Monitor process uptime and restart counts for services hosting the Prometheus exporter and alert on anomalies.
How to Mitigate CVE-2026-44902
Immediate Actions Required
- Upgrade @opentelemetry/exporter-prometheus to version 0.217.0 or later across all Node.js services.
- Restrict network access to the metrics port 9464 so it is reachable only from trusted Prometheus scrapers.
- Audit reverse proxies and ingress rules to ensure the exporter is not unintentionally exposed to the public internet.
Patch Information
The vulnerability is fixed in opentelemetry-js release 0.217.0. The fix adds error handling around URL parsing inside the Prometheus exporter's HTTP request handler so that malformed requests return an HTTP error response instead of crashing the host process. Refer to the GitHub Security Advisory GHSA-q7rr-3cgh-j5r3 for the upstream advisory and commit references.
Workarounds
- Bind the exporter to 127.0.0.1 instead of 0.0.0.0 and use a sidecar or local agent to relay metrics where possible.
- Place the metrics endpoint behind a network policy, firewall, or service mesh rule that allows only the Prometheus collector's source address.
- Configure process supervisors to restart on exit and add rate limiting upstream to slow repeated crash attempts until patching completes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
