CVE-2026-59892: OpenTelemetry JavaScript DoS Vulnerability

CVE-2026-59892 Overview

CVE-2026-59892 is a denial-of-service vulnerability in the OpenTelemetry JavaScript client, specifically in the @opentelemetry/propagator-jaeger package. Versions prior to 2.9.0 decode incoming uber-trace-id and uberctx-* HTTP headers using decodeURIComponent() without handling decode failures. An unauthenticated remote attacker can send a malformed percent-encoded value that raises an uncaught URIError. The uncaught exception terminates any Node.js process that uses JaegerPropagator as the active propagator. The issue is fixed in version 2.9.0 and is classified under [CWE-248: Uncaught Exception].

Critical Impact
A single crafted HTTP header crashes Node.js services relying on the Jaeger propagator, enabling remote, unauthenticated denial of service against production telemetry-instrumented workloads.

Affected Products

@opentelemetry/propagator-jaeger versions prior to 2.9.0
OpenTelemetry JavaScript client (opentelemetry-js) deployments using JaegerPropagator as the active propagator
Node.js services that accept uber-trace-id or uberctx-* headers from untrusted callers

Discovery Timeline

2026-07-08 - CVE-2026-59892 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59892

Vulnerability Analysis

The Jaeger propagator extracts distributed tracing context from inbound HTTP requests. Baggage entries carried in uberctx-* headers are URL-decoded to obtain their string values. The extraction path calls decodeURIComponent() directly on attacker-controlled header content without a surrounding try/catch. When the input contains an invalid percent-encoded sequence, decodeURIComponent() throws a URIError. Because propagator extraction runs synchronously on the request path, the exception bubbles up out of any handler that has not installed a global uncaughtException guard. Node.js then terminates the process, dropping in-flight requests and requiring a restart. The bug requires only a network reachable endpoint that forwards standard tracing headers, and works without authentication or user interaction.

Root Cause

The root cause is a missing exception boundary around decodeURIComponent() in JaegerPropagator.ts. The function has documented failure modes for malformed input, but the propagator treated it as infallible. This is a classic uncaught exception defect [CWE-248] in trusted-parsing code exposed to untrusted input.

Attack Vector

The attacker sends a single HTTP request with a header such as uberctx-key: %E0%A4%A (a truncated percent sequence). Any Node.js service configured with JaegerPropagator and reachable over the network will crash on extraction. Repeated requests keep the service unavailable.

typescript

       propagation.getBaggage(context) ?? propagation.createBaggage();
     for (const baggageEntry of baggageValues) {
       if (baggageEntry.value === undefined) continue;
+      let decodedValue: string;
+      try {
+        decodedValue = decodeURIComponent(baggageEntry.value);
+      } catch {
+        continue;
+      }
       currentBaggage = currentBaggage.setEntry(baggageEntry.key, {
-        value: decodeURIComponent(baggageEntry.value),
+        value: decodedValue,
       });
     }
     newContext = propagation.setBaggage(newContext, currentBaggage);

Source: GitHub Commit b1c196d. The patch wraps decodeURIComponent() in a try/catch and skips malformed baggage entries instead of propagating the URIError.

Detection Methods for CVE-2026-59892

Indicators of Compromise

Node.js process exits with an unhandled URIError: URI malformed originating in JaegerPropagator extraction
Repeated container or pod restarts correlated with inbound requests carrying malformed uber-trace-id or uberctx-* headers
Access logs showing header values containing incomplete percent-encoded sequences such as %, %E0%A4%A, or trailing %X

Detection Strategies

Inspect HTTP request logs and reverse-proxy telemetry for uber-trace-id or uberctx-* headers containing invalid percent-encoded bytes
Alert on Node.js uncaughtException events referencing packages/opentelemetry-propagator-jaeger in the stack trace
Correlate crash-loop signals from orchestrators (Kubernetes CrashLoopBackOff, systemd restart counters) with recent inbound tracing header patterns

Monitoring Recommendations

Ingest application stderr and process exit events into a centralized logging pipeline and search for URIError in propagator code paths
Track the installed version of @opentelemetry/propagator-jaeger across the fleet through software bill of materials (SBOM) or package manifest scanning
Rate-limit or filter tracing headers at ingress until affected services are patched

How to Mitigate CVE-2026-59892

Immediate Actions Required

Upgrade @opentelemetry/propagator-jaeger and transitive OpenTelemetry JavaScript packages to version 2.9.0 or later
Identify every Node.js service that registers JaegerPropagator via propagation.setGlobalPropagator() or a composite propagator and prioritize those exposed to untrusted networks
Enable ingress filtering to reject requests whose uber-trace-id or uberctx-* headers contain malformed percent-encoded sequences

Patch Information

The fix is included in OpenTelemetry JavaScript Release v2.9.0. Technical background is available in GitHub Security Advisory GHSA-45rx-2jwx-cxfr and the fix commit b1c196d.

Workarounds

Temporarily replace JaegerPropagator with an alternative propagator such as W3C Trace Context until the upgrade is deployed
Strip or sanitize uber-trace-id and uberctx-* headers at the load balancer, API gateway, or service mesh before requests reach Node.js services
Install a defensive process.on('uncaughtException') handler as a short-term safeguard, while recognizing that this is not a substitute for the official patch

bash

# Upgrade the vulnerable package to the fixed version
npm install @opentelemetry/propagator-jaeger@^2.9.0

# Verify the installed version across the project
npm ls @opentelemetry/propagator-jaeger