CVE-2026-44902: Opentelemetry Opentelemetry/auto-instrumentations-node vulnerability (CVSS 7.5)

Description

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Opentelemetry Opentelemetry/auto-instrumentations-node< 0.75.0

Opentelemetry Opentelemetry/exporter-prometheus< 0.217.0

Opentelemetry Opentelemetry/sdk-node< 0.217.0

Remediation

Fixed in

Opentelemetry Opentelemetry/auto-instrumentations-node≥ 0.75.0

Opentelemetry Opentelemetry/exporter-prometheus≥ 0.217.0

Opentelemetry Opentelemetry/sdk-node≥ 0.217.0

Patch & vendor advisories

https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3

References

https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3ExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-44902 being actively exploited?

CVE-2026-44902 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.49%.

How severe is CVE-2026-44902?

CVE-2026-44902 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.49% probability of exploitation.

Which products are affected by CVE-2026-44902?

Affected products include Opentelemetry Opentelemetry/auto-instrumentations-node, Opentelemetry Opentelemetry/exporter-prometheus, Opentelemetry Opentelemetry/sdk-node.

How do I fix CVE-2026-44902?

Upgrade affected software to a fixed version, for example Opentelemetry Opentelemetry/auto-instrumentations-node 0.75.0, Opentelemetry Opentelemetry/exporter-prometheus 0.217.0, Opentelemetry Opentelemetry/sdk-node 0.217.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-44902 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo