# CVE-2026-59892: OpenTelemetry opentelemetry-js denial of service in JaegerPropagator

Source: https://junglewise.ai/threats/cve-2026-59892-opentelemetry-opentelemetry-js-denial-of-service-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59892 · Severity: high · CVSS 7.5 · Published 2026-07-08

OpenTelemetry's Jaeger Propagator is a library component that extracts trace context from HTTP request headers to enable distributed request tracing. An attacker can crash any Node.js service using this component by sending a single HTTP request with a malformed percent-encoded value in a trace header, causing immediate service unavailability and forcing process restarts.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-59892 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59892 being exploited in the wild.

**How severe is CVE-2026-59892?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** @opentelemetry/propagator-jaeger (npm) < 2.9.0, SEMVER:introduced=0,fixed=2.9.0; Opentelemetry-Js (@Opentelemetry/Propagator-Jaeger) < 2.9.0; Opentelemetry Propagator Jaeger < 2.9.0.

**Is there a fix for CVE-2026-59892?** Yes. @opentelemetry/propagator-jaeger (npm): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59892 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59892?** Check whether you run @opentelemetry/propagator-jaeger (npm), Opentelemetry-Js (@Opentelemetry/Propagator-Jaeger) or Opentelemetry Propagator Jaeger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @opentelemetry/propagator-jaeger (npm): upgrade to 2.9.0 or later

  ```sh
  npm install @opentelemetry/propagator-jaeger@2.9.0
  ```


## Technical details

The vulnerability is a missing exception handler (CWE-248) in the JaegerPropagator.extract() method. The component calls decodeURIComponent() on raw HTTP header values without catching URIError exceptions thrown by invalid percent-encoding (e.g., a bare '%' character). Because HTTP instrumentation extracts propagation context before its error wrapper, and a single propagator is not wrapped in error handling, the uncaught exception propagates as an uncaughtException, terminating the Node.js process. Attack vector is network-based, requiring no authentication or user interaction. Affected versions are all versions before 2.9.0. The patch wraps decode operations with error handling to silently ignore malformed headers instead of throwing.

## Affected products

- OpenTelemetry @opentelemetry/propagator-jaeger < 2.9.0

## Identifiers

- CVE-2026-59892
- GHSA-45rx-2jwx-cxfr

## Timeline

- 2026-07-21: disclosed: GitHub Security Advisory GHSA-45rx-2jwx-cxfr published
- 2026-07-02: patched: Fix released in version 2.9.0

## References

- [https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr](https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr)
- [https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88](https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88)
- [https://github.com/open-telemetry/opentelemetry-js](https://github.com/open-telemetry/opentelemetry-js)
- [https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0](https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0)