{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@opentelemetry/propagator-jaeger--2.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59892"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@opentelemetry/propagator-jaeger (\u003c 2.9.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","javascript","nodejs","opentelemetry"],"_cs_type":"advisory","_cs_vendors":["OpenTelemetry"],"content_html":"\u003cp\u003eAn unauthenticated remote denial-of-service vulnerability (CVE-2026-59892) affects Node.js applications utilizing \u003ccode\u003e@opentelemetry/propagator-jaeger\u003c/code\u003e versions older than 2.9.0. This flaw allows an attacker to send a specially crafted HTTP request containing a malformed percent-encoded value (such as a bare '%') within the \u003ccode\u003euber-trace-id\u003c/code\u003e or \u003ccode\u003euberctx-*\u003c/code\u003e HTTP headers. When \u003ccode\u003eJaegerPropagator\u003c/code\u003e attempts to decode this malformed header value using \u003ccode\u003edecodeURIComponent()\u003c/code\u003e, an uncaught \u003ccode\u003eURIError\u003c/code\u003e is triggered. If \u003ccode\u003eJaegerPropagator\u003c/code\u003e is configured as the sole active propagator, this exception propagates as an \u003ccode\u003euncaughtException\u003c/code\u003e, causing the entire Node.js process to terminate immediately. This vulnerability allows for easy service disruption with a single request.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends an HTTP request to a target Node.js service.\u003c/li\u003e\n\u003cli\u003eThe HTTP request includes a header, such as \u003ccode\u003euber-trace-id\u003c/code\u003e or \u003ccode\u003euberctx-*\u003c/code\u003e, with a malformed percent-encoded value (e.g., \u003ccode\u003euber-trace-id: %\u003c/code\u003e or \u003ccode\u003euberctx-user: %\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe target service is running a Node.js application that uses \u003ccode\u003e@opentelemetry/propagator-jaeger\u003c/code\u003e version \u0026lt; 2.9.0.\u003c/li\u003e\n\u003cli\u003eThe application has \u003ccode\u003eJaegerPropagator\u003c/code\u003e registered as its active global propagator (e.g., via \u003ccode\u003eOTEL_PROPAGATORS=jaeger\u003c/code\u003e or \u003ccode\u003epropagation.setGlobalPropagator(new JaegerPropagator())\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDuring context extraction, the \u003ccode\u003eJaegerPropagator.extract()\u003c/code\u003e method attempts to decode the malformed header value using \u003ccode\u003edecodeURIComponent()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edecodeURIComponent()\u003c/code\u003e function throws a \u003ccode\u003eURIError: URI malformed\u003c/code\u003e due to the invalid percent-encoding.\u003c/li\u003e\n\u003cli\u003eSince the \u003ccode\u003eJaegerPropagator\u003c/code\u003e is not wrapped by a \u003ccode\u003eCompositePropagator\u003c/code\u003e (which would catch the error), the \u003ccode\u003eURIError\u003c/code\u003e propagates as an \u003ccode\u003euncaughtException\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Node.js process immediately terminates, resulting in a denial of service for the application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to a severe denial of service, allowing any unauthenticated remote attacker to terminate vulnerable Node.js applications with a single HTTP request. This disrupts service availability and can lead to significant downtime for affected organizations. The impact is specifically on service availability; confidentiality and integrity of data are not directly affected by this particular flaw. Organizations in any sector using the affected OpenTelemetry library configurations are susceptible to this easy-to-exploit DoS vector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@opentelemetry/propagator-jaeger\u003c/code\u003e to version 2.9.0 or later to patch CVE-2026-59892.\u003c/li\u003e\n\u003cli\u003eAs an interim mitigation, if immediate upgrading is not possible, implement controls at your edge (e.g., reverse proxy, API gateway, or load balancer like Nginx or Envoy) to strip or validate \u003ccode\u003euber-trace-id\u003c/code\u003e and \u003ccode\u003euberctx-*\u003c/code\u003e headers on all inbound requests. Ensure these headers are only accepted from trusted upstream services.\u003c/li\u003e\n\u003cli\u003eVerify if your \u003ccode\u003eOTEL_PROPAGATORS\u003c/code\u003e environment variable is set to include \u003ccode\u003ejaeger\u003c/code\u003e or if \u003ccode\u003epropagation.setGlobalPropagator(new JaegerPropagator())\u003c/code\u003e is called in your code.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:12:07Z","date_published":"2026-07-21T19:12:07Z","id":"https://feed.craftedsignal.io/briefs/2026-07-opentelemetry-jaeger-dos/","summary":"A critical denial of service vulnerability, CVE-2026-59892, exists in `@opentelemetry/propagator-jaeger` versions prior to 2.9.0, allowing an unauthenticated remote attacker to terminate Node.js applications configured with `JaegerPropagator` by sending a malformed percent-encoded value in `uber-trace-id` or `uberctx-*` HTTP headers, leading to an uncaught `URIError`.","title":"CVE-2026-59892: OpenTelemetry JaegerPropagator Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-opentelemetry-jaeger-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - @Opentelemetry/Propagator-Jaeger (\u003c 2.9.0)","version":"https://jsonfeed.org/version/1.1"}