{"action":"Upgrade @opentelemetry/propagator-jaeger to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0"}],"component":"@opentelemetry/propagator-jaeger","cve_ids":["CVE-2026-59892"],"ecosystem":"npm","epss":0.00557,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-45rx-2jwx-cxfr","id":"tcs_01M5KEZEYGJV39H2KJ1077G0TS","modified_at":"2026-09-10T03:50:51.338220338Z","published_at":"2026-07-21T19:07:28Z","references":["https://osv.dev/vulnerability/GHSA-45rx-2jwx-cxfr","https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr","https://nvd.nist.gov/vuln/detail/CVE-2026-59892","https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","https://github.com/open-telemetry/opentelemetry-js","https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-45rx-2jwx-cxfr","url":"https://osv.dev/vulnerability/GHSA-45rx-2jwx-cxfr"}],"summary":"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header"}