CVE-2026-44902: opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

Synopsis

This is a denial-of-service vulnerability in the OpenTelemetry JavaScript client's Prometheus exporter. A remote attacker with no authentication can send a single malformed HTTP request with an invalid URI to the metrics endpoint (default port 9464), triggering an uncaught TypeError that terminates the entire Node.js process. Successful exploitation crashes the host process, taking down any application relying on it. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Prometheus metrics endpoint over the network; by default it binds to 0.0.0.0:9464 and is accessible from any reachable host.

• AuthenticationNot required

  The metrics endpoint requires no credentials, so any client that can open a TCP connection can send the malformed request.

• Victim interactionNot required

  No user or operator action is needed; the crash is triggered entirely by the inbound HTTP request.

• Attack complexityDetail

  Exploitation is reliable and condition-free: a single crafted request with a malformed URI consistently triggers the uncaught TypeError regardless of environment state.

Blast Radius

• The targeted Node.js process is terminated immediately, taking down every service or workload running inside that process.
• Any in-flight requests or background jobs running in the same process are dropped without completing.
• If the process is not automatically restarted, the metrics pipeline goes dark, removing observability coverage for the affected service.