Homanp

The library coerces all-digit PAX path and linkpath values in `src/pax.ts` to JavaScript numbers. This behavior causes downstream path handling, such as `normalizeWindowsPath(entry.path).split('/')`, to throw an uncaught TypeError.

A single malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default '0.0.0.0:9464') lacks error handling during URL parsing. When a request with an invalid URI is received, the ` requestHandler` function calls the `URL` constructor, which throws an uncaught `TypeError`, resulting in a denial of service. This occurs because the HTTP parser accepts absolute-form URIs for proxy compatibility, and a value such as "http://" triggers the exception. The endpoint is unauthenticated by design and binds to '0.0.0.0' by default, making it reachable by any network client.