--- id: "CVE-2026-44902" kind: "vulnerability" aliases: ["CVE-2026-44902", "GHSA-q7rr-3cgh-j5r3"] title: "Prometheus exporter process crash via malformed HTTP request" severity: "high" cvss: 7.5 epss: 0.004860000219196081 exploited: false status: "open" category: "package" products: [{"name": "@opentelemetry/exporter-prometheus", "fixed": ["0.217.0"], "affected": "< 0.217.0", "ecosystem": "npm"}, {"name": "@opentelemetry/sdk-node", "fixed": ["0.217.0"], "affected": ">= 0.57.0, < 0.217.0", "ecosystem": "npm"}, {"name": "@opentelemetry/auto-instrumentations-node", "fixed": ["0.75.0"], "affected": ">= 0.55.0, < 0.75.0", "ecosystem": "npm"}, {"name": "opentelemetry opentelemetry\\/auto-instrumentations-node", "fixed": ["0.75.0"], "affected": "< 0.75.0", "ecosystem": "vendor"}, {"name": "opentelemetry opentelemetry\\/exporter-prometheus", "fixed": ["0.217.0"], "affected": "< 0.217.0", "ecosystem": "vendor"}, {"name": "opentelemetry opentelemetry\\/sdk-node", "fixed": ["0.217.0"], "affected": "< 0.217.0", "ecosystem": "vendor"}] ecosystems: ["npm", "vendor"] tags: ["cwe-755", "kubernetes", "node.js", "opentelemetry", "package", "prometheus", "self-hosted"] not_affected_if: ["already-on-0.217.0", "metrics-port-not-reachable", "no-prometheus-exporter"] published_at: "2026-05-11T14:42:10+00:00" first_seen_at: "2026-10-23T19:11:32+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-q7rr-3cgh-j5r3", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44902", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # Prometheus exporter process crash via malformed HTTP request A single malformed HTTP request to the OpenTelemetry JS Prometheus exporter's metrics port makes an uncaught TypeError crash the whole Node.js process. An unauthenticated attacker on a network that can reach the port gets a remote denial of service. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - npm:@opentelemetry/exporter-prometheus affected < 0.217.0 fixed 0.217.0 - npm:@opentelemetry/sdk-node affected >= 0.57.0, < 0.217.0 fixed 0.217.0 - npm:@opentelemetry/auto-instrumentations-node affected >= 0.55.0, < 0.75.0 fixed 0.75.0 - vendor:opentelemetry opentelemetry\/auto-instrumentations-node affected < 0.75.0 fixed 0.75.0 - vendor:opentelemetry opentelemetry\/exporter-prometheus affected < 0.217.0 fixed 0.217.0 - vendor:opentelemetry opentelemetry\/sdk-node affected < 0.217.0 fixed 0.217.0 ## How to check Check whether @opentelemetry/exporter-prometheus is installed below 0.217.0 (npm ls @opentelemetry/exporter-prometheus). Check whether @opentelemetry/sdk-node or @opentelemetry/auto-instrumentations-node is in use with OTEL_METRICS_EXPORTER including prometheus. ## Fix Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to 0.217.0 or later, and @opentelemetry/auto-instrumentations-node to 0.75.0 or later. Until updated, bind the exporter to 127.0.0.1 or firewall port 9464 to trusted scrapers only. ## Timeline - 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-q7rr-3cgh-j5r3 - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44902 ## From the sources ## Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process. **You are affected by this vulnerability if either of the following apply to your application:** * you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server. * your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND** * you use `@opentelemetry/sdk-node` * you use `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register` ## Impact **Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required. ## Remediation ### Update to the fixed version Update `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. Update `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later. This release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process. ``` npm install @opentelemetry/exporter-prometheus@latest ``` ### Do Not Expose the Endpoint to Untrusted Users > [!IMPORTANT] > The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution. If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example: * **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces * **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts * **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter ## Details In `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `"http://"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process. The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port. ## Proof of Concept Start any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet: ``` echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464 ``` The process crashes immediately with: ``` TypeError: Invalid URL at new URL (...) at PrometheusExporter._requestHandler (...) ``` --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_