Overview
About vulnerability
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.Details
- Affected product:
- clients , gateway , graphql-hive-gateway , graphql-hive-plugin-opentelemetry , honeycomb-opentelemetry-js , ipx , netlify-dev , netlify-functions-dev , netlify-opentelemetry-sdk-setup , netlify-runtime , netlify-vite-plugin , opentelemetry-auto-instrumentations-node , opentelemetry-js , opentelemetry-js-contrib , opentelemetry-propagator-jaeger , opentelemetry-sdk-node , opentelemetry-sdk-trace-node , otel , primitives , rspack , unstorage
- Affected packages:
- @opentelemetry/propagator-jaeger @ 0.24.0 (+138 more)