npm/@opentelemetry/sdk-node CVE-2026-44902: high 7.5, EPSS 0.47%

Prometheus exporter process crash via malformed HTTP request

Action: Upgrade @opentelemetry/sdk-node to 0.217.0 or later.

npm i @opentelemetry/sdk-node@0.217.0

Affected

Fixed versions

Sources

• osv: GHSA-q7rr-3cgh-j5r3#npm/@opentelemetry/sdk-node
• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3
• https://nvd.nist.gov/vuln/detail/CVE-2026-44902
• https://github.com/github/advisory-database/pull/10226
• https://github.com/open-telemetry/opentelemetry-js
• https://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95
• https://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55

CVE-2026-44902 · published 2026-05-11T14:42:10Z · modified 2026-10-19T19:45:04.420749729Z · JSON