{"id":"CVE-2026-44902","kind":"vulnerability","aliases":["CVE-2026-44902","GHSA-q7rr-3cgh-j5r3"],"related":[],"title":"Prometheus exporter process crash via malformed HTTP request","description":"## Summary\n\nA single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process.\n\n**You are affected by this vulnerability if either of the following apply to your application:**\n\n* you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server.\n* your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND**\n  * you use `@opentelemetry/sdk-node`\n  * you use  `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register`\n\n## Impact\n\n**Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.\n\n## Remediation\n\n### Update to the fixed version\n\nUpdate `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. \nUpdate `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later.\n\nThis release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process.\n\n```\nnpm install @opentelemetry/exporter-prometheus@latest\n```\n\n### Do Not Expose the Endpoint to Untrusted Users\n\n> [!IMPORTANT] \n> The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution.\n\nIf updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:\n\n* **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces\n\n* **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts\n\n* **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter\n\n## Details\n\nIn `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `\"http://\"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.\n\nThe Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port.\n\n## Proof of Concept\n\nStart any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet:\n\n```\necho -ne 'GET http:// HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' | nc localhost 9464\n```\n\nThe process crashes immediately with:\n\n```\nTypeError: Invalid URL\n    at new URL (...)\n    at PrometheusExporter._requestHandler (...)\n```","summary":"A single malformed HTTP request to the OpenTelemetry JS Prometheus exporter's metrics port makes an uncaught TypeError crash the whole Node.js process. An unauthenticated attacker on a network that can reach the port gets a remote denial of service.","severity":"high","cvss":7.5,"epss":0.004860000219196081,"exploited":false,"exploited_at":null,"products":[{"name":"@opentelemetry/exporter-prometheus","fixed":["0.217.0"],"affected":"< 0.217.0","ecosystem":"npm"},{"name":"@opentelemetry/sdk-node","fixed":["0.217.0"],"affected":">= 0.57.0, < 0.217.0","ecosystem":"npm"},{"name":"@opentelemetry/auto-instrumentations-node","fixed":["0.75.0"],"affected":">= 0.55.0, < 0.75.0","ecosystem":"npm"},{"name":"opentelemetry opentelemetry\\/auto-instrumentations-node","fixed":["0.75.0"],"affected":"< 0.75.0","ecosystem":"vendor"},{"name":"opentelemetry opentelemetry\\/exporter-prometheus","fixed":["0.217.0"],"affected":"< 0.217.0","ecosystem":"vendor"},{"name":"opentelemetry opentelemetry\\/sdk-node","fixed":["0.217.0"],"affected":"< 0.217.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-755","kubernetes","node.js","opentelemetry","package","prometheus","self-hosted"],"not_affected_if":["already-on-0.217.0","metrics-port-not-reachable","no-prometheus-exporter"],"how_to_check":"Check whether @opentelemetry/exporter-prometheus is installed below 0.217.0 (npm ls @opentelemetry/exporter-prometheus).\nCheck whether @opentelemetry/sdk-node or @opentelemetry/auto-instrumentations-node is in use with OTEL_METRICS_EXPORTER including prometheus.","fix":"Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to 0.217.0 or later, and @opentelemetry/auto-instrumentations-node to 0.75.0 or later.\nUntil updated, bind the exporter to 127.0.0.1 or firewall port 9464 to trusted scrapers only.","status":"open","published_at":"2026-05-11T14:42:10+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T21:45:41+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T21:45:41Z","model":"claude-haiku-5-5","output":{"fix":"Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to 0.217.0 or later, and @opentelemetry/auto-instrumentations-node to 0.75.0 or later.\nUntil updated, bind the exporter to 127.0.0.1 or firewall port 9464 to trusted scrapers only.","reach":"network","impact":"low","summary":"A single malformed HTTP request to the OpenTelemetry JS Prometheus exporter's metrics port makes an uncaught TypeError crash the whole Node.js process. An unauthenticated attacker on a network that can reach the port gets a remote denial of service.","category":"package","who_cares":["node.js","opentelemetry","prometheus","self-hosted","kubernetes"],"confidence":0.9,"needs_auth":"no","worst_case":"Any network client crashes the Node.js process with one request.","analyst_note":"","how_to_check":"Check whether @opentelemetry/exporter-prometheus is installed below 0.217.0 (npm ls @opentelemetry/exporter-prometheus).\nCheck whether @opentelemetry/sdk-node or @opentelemetry/auto-instrumentations-node is in use with OTEL_METRICS_EXPORTER including prometheus.\nUnknown whether the metrics port (default 9464) is reachable from untrusted networks.","needs_analyst":false,"not_affected_if":["no-prometheus-exporter","metrics-port-not-reachable","already-on-0.217.0"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4150,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-44902':11A,19A '-755':33B '/auto-instrumentations-node':25A '/exporter-prometheus':28A '/sdk-node':31A '0.0.0.0':102C,487C '0.217.0':225C,312C '0.75.0':232C '127.0.0.1':353C '3cgh':15A '400':248C '9464':103C,381C,521C,542C 'absolut':432C 'absolute-form':431C 'accept':430C 'access':210C,324C,378C 'add':237C 'affect':128C 'allow':255C 'appli':137C 'applic':140C,179C,511C 'around':108C,241C 'attack':67B 'authent':205C 'behind':397C 'bind':343C,485C 'built':151C,187C 'built-in':150C,186C 'call':417C 'catch':458C 'caus':118C 'client':290C,340C,497C 'code':147C 'compat':438C 'compromis':304C 'concept':507C 'configur':355C,387C 'connect':500C 'constructor':244C,447C 'could':305C 'crash':4A,60B,88C,192C,261C,309C,470C,545C 'cve':9A,17A 'cwe':32B 'default':101C,489C,519C 'denial':79B,175C 'design':480C 'detail':412C 'direct':142C 'e.g':435C 'echo':529C 'either':133C 'endpoint':100C,272C,296C,328C,396C,476C 'environ':158C 'error':106C,239C,424C 'exampl':342C 'except':257C,463C,468C 'export':2A,52B,97C,157C,184C,411C,515C 'expos':270C,363C 'exposur':281C 'failur':252C 'feasibl':322C 'filter':402C 'firewal':372C 'fix':217C 'follow':136C,278C 'form':433C 'fulli':285C 'get':76B,531C 'ghsa':13A 'ghsa-q7rr-3cgh-j5r3':12A 'handl':107C,240C,425C 'handler':461C 'host':41B,302C,350C,393C 'http':7A,45B,86C,247C,428C 'http/1.1':532C 'immedi':321C,546C 'impact':174C 'import':172C,276C 'includ':160C,297C,439C 'incom':405C 'instal':265C 'interfac':369C 'invalid':116C,450C,549C 'j5r3':16A 'js':50B,95C 'kubernet':34B 'later':227C,234C 'latest':267C 'localhost':345C,535C,541C 'make':56B 'malform':6A,44B,85C,440C 'mean':490C 'metric':54B,99C,156C,202C,295C,327C,475C,503C 'mitig':279C 'n':537C,539C 'nc':540C 'ne':530C 'network':70B,197C,339C,368C,374C,496C 'new':418C,552C 'nhost':534C 'node':426C 'node.js':35B,63B,90C,510C 'npm':264C 'one':441C 'opentelemetri':36B,49B,94C,182C 'opentelemetry':23A,24A,26A,27A,29A,30A 'opentelemetry/auto-instrumentations-node':22A,168C,229C 'opentelemetry/auto-instrumentations-node/register':171C,173C 'opentelemetry/exporter-prometheus':20A,144C,220C,266C 'opentelemetry/sdk-node':21A,165C,222C 'option':351C 'otel':155C 'packag':37B 'packet':198C,528C 'pars':110C,251C 'parser':429C 'place':394C 'polici':375C 'port':55B,75B,203C,360C,380C,384C,504C,520C 'prior':209C 'privileg':207C 'process':3A,64B,91C,125C,263C,472C,544C 'prometheus':1A,38B,51B,96C,161C,183C,300C,391C,474C,481C,514C 'prometheusexport':357C 'prometheusexporter._requesthandler':555C 'prometheusexporter.ts':414C 'proof':505C 'propag':259C,464C 'proper':238C 'proxi':400C,437C 'public':365C 'q7rr':14A 'r':533C,536C,538C 'rather':253C 'raw':526C 'reach':73B,293C,409C 'reachabl':334C,493C 'recommend':315C 'reduc':280C 'releas':236C 'remedi':213C,286C 'remot':78B 'request':8A,46B,87C,113C,406C 'request.url':420C,443C 'requesthandl':416C 'requir':170C,212C 'resolut':316C 'respons':249C 'restrict':323C,377C 'return':245C 'revers':399C 'run':92C,516C 'scrape':392C,482C 'scraper':301C 'self':40B 'self-host':39B 'send':523C 'sent':199C 'server':153C,189C 'servic':81B,177C 'set':348C 'share':367C 'sinc':452C 'singl':43B,84C,195C,525C 'special':206C 'start':508C 'still':306C 'summari':82C 'tcp':527C 'termin':123C 'this._baseurl':421C 'throw':448C 'tri':457C 'trigger':307C 'trust':390C 'try-catch':456C 'typeerror':59B,121C,449C,548C 'unauthent':66B,196C,338C,478C 'uncaught':58B,120C,467C 'untrust':274C,336C 'updat':214C,219C,228C,310C,318C 'uri':117C,434C 'url':109C,243C,419C,446C,451C,550C,553C 'use':143C,164C,167C,180C,370C 'user':275C 'valid':404C 'variabl':159C 'version':218C,224C,231C 'via':5A,169C 'vulner':131C,288C 'whichev':383C 'whole':62B 'without':422C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-11T14:42:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-q7rr-3cgh-j5r3","url":"https://github.com/advisories/GHSA-q7rr-3cgh-j5r3","severity":"high","published_at":"2026-05-11T14:42:10+00:00","modified_at":"2026-10-19T19:35:40+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44902","severity":null,"published_at":"2026-05-27T15:16:29+00:00","modified_at":"2026-08-27T16:16:49+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}