VDB

CVE-2026-59892

CVE-2026-59892 PUBLISHED CVSS 7.5 HIGH

Reported by GitHub_M · Published July 8, 2026

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
open-telemetryopentelemetry-js< 2.9.0
chainguardlangfuse-20, 0, 0
chainguardcadence-web0, 0, 0
chainguardkibana-9.30, 0, 0
chainguardlangfuse-fips-20, 0, 0
opentelemetrypropagator-jaeger0
chainguardgemini-cli0, 0, 0
chainguardkibana-9.10, 0, 0
chainguardkibana-9.40, 0, 0
chainguardlibrechat0, 0, 0
open-telemetryopentelemetry-js< 2.9.0, < 2.9.0
chainguardkibana-8.190, 0, 0
chainguardkibana-9.00, 0, 0
chainguardkibana-9.20, 0, 0

Timeline

  • Jul 8, 2026 CVE Published
  • Jul 9, 2026 EPSS Score
  • Jul 9, 2026 Coalition ESS Score
  • Jul 21, 2026 CVE Updated
  • Jul 29, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›