CVE-2026-59892

Name of the Vulnerable Software and Affected Versions @opentelemetry/propagator-jaeger versions prior to 2.9.0

Description The @opentelemetry/propagator-jaeger component decodes incoming uber-trace-id and uberctx-* HTTP header values using the decodeURIComponent() function without proper error handling. An unauthenticated remote attacker can send a malformed percent-encoded value, triggering an uncaught URIError (a type of error occurring when the URI decoding function encounters an invalid sequence) that terminates the Node.js process utilizing the JaegerPropagator as the active propagator.

Recommendations Update to version 2.9.0.