CVE-2026-59892: OpenTelemetry Jaeger Propagator Denial-of-Service via Malformed Headers

Technical summary

CVE-2026-59892 is a denial-of-service vulnerability in @opentelemetry/propagator-jaeger versions prior to 2.9.0. The JaegerPropagator parses incoming HTTP headers (uber-trace-id and uberctx-*) by calling decodeURIComponent() on untrusted values without wrapping the call in error handling. When a malformed percent-encoded string is provided—for example, an incomplete escape sequence—decodeURIComponent() throws a URIError exception that propagates uncaught, terminating the Node.js process. The vulnerability is classified as CWE-248 (Uncaught Exception).

Business impact

Applications using JaegerPropagator become susceptible to process crashes triggered by external HTTP requests. In production environments, this enables attackers to cause repeated service unavailability without authentication or credentials. Microservices architectures relying on OpenTelemetry tracing with Jaeger propagation are particularly exposed, as incoming trace headers from any source (reverse proxies, API gateways, client applications) become an attack surface. The impact scales with traffic volume and network exposure.

Affected systems

@opentelemetry/propagator-jaeger versions prior to 2.9.0 are affected. The vulnerability is triggered in any Node.js application that imports and activates JaegerPropagator as the active trace context propagator. No specific application versions are universally affected; vulnerability depends on the OpenTelemetry package version in use. Applications must be verified individually against their dependency tree.

Exploitability

Exploitability is high and requires minimal effort. An attacker needs only to send a single HTTP request with a malformed header value (such as uber-trace-id: %ZZ or similar invalid encoding) to a vulnerable endpoint. No authentication, special privileges, or user interaction is required. The attack is reliable—every crafted request to a service using an affected version may trigger a crash. Remote network access is the only prerequisite.

Remediation

Upgrade @opentelemetry/propagator-jaeger to version 2.9.0 or later, which includes error handling around decodeURIComponent() calls. This fix ensures that malformed headers are gracefully handled rather than terminating the process. Verify the update is applied across all Node.js services in your infrastructure that use this package. Testing should confirm that trace context propagation continues to function correctly after the upgrade.

Patch guidance

Update the @opentelemetry/propagator-jaeger package to 2.9.0 or later using your package manager (npm update @opentelemetry/propagator-jaeger or yarn upgrade @opentelemetry/propagator-jaeger). Review your lock file to confirm the version change. Redeploy affected Node.js services. No breaking changes are documented in the fix, so a straightforward version bump should resolve the vulnerability. Verify against the official OpenTelemetry release notes to confirm version 2.9.0 availability in your package registry.

Detection guidance

Monitor Node.js process restarts and logs for URIError exceptions related to decodeURIComponent() or trace header parsing. Inspect incoming HTTP traffic for malformed percent-encoded values in headers beginning with uber-trace-id or uberctx-. In production, correlate process crash events with unusual or suspicious external HTTP traffic patterns. Developers can reproduce the issue in test environments by manually crafting requests with invalid percent-encoding (e.g., curl -H 'uber-trace-id: %ZZ' http://target) and observing whether the process terminates.

Why prioritize this

This vulnerability merits high priority remediation despite not being in CISA's Known Exploited Vulnerabilities catalog. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and direct availability impact. The attack surface is broad—any inbound HTTP request can trigger it—and the damage is immediate and noticeable (service outage). Organizations running production microservices on Node.js with OpenTelemetry tracing should patch urgently to prevent operational disruption.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects an attack vector of Network (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N). This accurately captures the ease of triggering a denial-of-service condition from any network-connected attacker against a publicly exposed service.

Frequently asked questions