Description
@opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %) in an uber-trace-id or uberctx-* header throws an uncaught URIError, terminating any Node.
Recommendation
Update the @opentelemetry/propagator-jaeger package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.9.0
- Patched version(s): 2.9.0
References
Could your website be exposed too?
SmartScanner can check your website for OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - CVE-2026-33939
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
- liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
You might also like:
See something that needs correcting? Let us knowUpdated July 21, 2026