OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0,
    @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with
    decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a
    malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using
    JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0. (CVE-2026-59892)

ID	Name	Product	Family	Type	Severity
460501	Echo: @opentelemetry/propagator-jaeger: security update to 2.9.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460501	Echo: @opentelemetry/propagator-jaeger: security update to 2.9.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
445119	SCA: security update for @opentelemetry/propagator-jaeger (GHSA-45rx-2jwx-cxfr)	Tenable Cloud Security	SCA Checks	Local	high
445119	SCA: security update for @opentelemetry/propagator-jaeger (GHSA-45rx-2jwx-cxfr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-59892

high

Tenable Plugins

high

high

high

high