Executive brief
OpenTelemetry's Jaeger Propagator is a library component that extracts trace context from HTTP request headers to enable distributed request tracing. An attacker can crash any Node.js service using this component by sending a single HTTP request with a malformed percent-encoded value in a trace header, causing immediate service unavailability and forcing process restarts.
Technical details
The vulnerability is a missing exception handler (CWE-248) in the JaegerPropagator.extract() method. The component calls decodeURIComponent() on raw HTTP header values without catching URIError exceptions thrown by invalid percent-encoding (e.g., a bare '%' character). Because HTTP instrumentation extracts propagation context before its error wrapper, and a single propagator is not wrapped in error handling, the uncaught exception propagates as an uncaughtException, terminating the Node.js process. Attack vector is network-based, requiring no authentication or user interaction. Affected versions are all versions before 2.9.0. The patch wraps decode operations with error handling to silently ignore malformed headers instead of throwing.
Affected products
- OpenTelemetry @opentelemetry/propagator-jaeger < 2.9.0
Timeline
- 2026-07-21: disclosed: GitHub Security Advisory GHSA-45rx-2jwx-cxfr published
- 2026-07-02: patched: Fix released in version 2.9.0
References
- https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr
- https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88
- https://github.com/open-telemetry/opentelemetry-js
- https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0