{"action":"Upgrade @opentelemetry/exporter-prometheus to 0.217.0 or later.","affected":[{"fixed":"0.217.0","introduced":"0"}],"component":"@opentelemetry/exporter-prometheus","cve_ids":["CVE-2026-44902"],"ecosystem":"npm","epss":0.00473,"exploited":false,"fixed_versions":["0.217.0"],"ghsa_id":"GHSA-q7rr-3cgh-j5r3","id":"tcs_01M5JJ2QS1QBMVFFCTMH8QTMV2","modified_at":"2026-10-19T19:45:04.420749729Z","published_at":"2026-05-11T14:42:10Z","references":["https://osv.dev/vulnerability/GHSA-q7rr-3cgh-j5r3","https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3","https://nvd.nist.gov/vuln/detail/CVE-2026-44902","https://github.com/github/advisory-database/pull/10226","https://github.com/open-telemetry/opentelemetry-js","https://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95","https://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q7rr-3cgh-j5r3","url":"https://osv.dev/vulnerability/GHSA-q7rr-3cgh-j5r3"}],"summary":"Prometheus exporter process crash via malformed HTTP request"}