OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Description

@opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %) in an uber-trace-id or uberctx-* header throws an uncaught URIError, terminating any Node.

Recommendation

Update the @opentelemetry/propagator-jaeger package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.9.0
• Patched version(s): 2.9.0

References

• GHSA-45rx-2jwx-cxfr
• CVE-2026-59892
• CWE-248
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - CVE-2026-33939
• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
• liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
• Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

@opentelemetry/propagator-jaeger