high · 7.5CVE-2026-59892Jul 21, 2026

CVE-2026-59892: @opentelemetry/propagator-jaeger Denial of Service via Malformed Header

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A single HTTP request with a broken percent-encoded value in a Jaeger trace header crashes any Node.js service that uses JaegerPropagator as its active propagator, taking the whole process down.

Package@opentelemetry/propagator-jaeger
Ecosystemnpm
Affected< 2.9.0
Fixed in2.9.0

The problem

JaegerPropagator.extract() calls decodeURIComponent() on raw HTTP header values at two places: the uber-trace-id trace header and each uberctx-* baggage header. Neither call site is wrapped in error handling.

decodeURIComponent() throws a URIError on any invalid percent sequence (for example, a bare %). Because HTTP instrumentation extracts context before the request-handler error boundary, and a single configured propagator is not wrapped in a CompositePropagator, the exception propagates as an uncaughtException and terminates the Node.js process.

One request from any unauthenticated remote attacker is enough to take down the service.

Proof of concept

A working proof-of-concept for CVE-2026-59892 in @opentelemetry/propagator-jaeger, with the exact payload below.

bash
# Kill the process via the baggage header:
curl -H 'uberctx-user: %' http://target/

# Or via the trace header:
curl -H 'uber-trace-id: %' http://target/

The root cause is CWE-248: Uncaught Exception. decodeURIComponent() is not a safe parser for untrusted input because it throws URIError on sequences like a bare % that cannot be completed.

The patch (commit b1c196d) wraps both call sites in try/catch blocks. When decoding fails, the propagator now returns early and ignores the header instead of letting the exception bubble up. The fix is minimal: no new dependency, no behavior change for well-formed headers.

The fix

Update @opentelemetry/propagator-jaeger to 2.9.0 or later. If you cannot update immediately, strip or reject the uber-trace-id and uberctx-* headers at your edge (nginx, Envoy, an API gateway) before they reach the Node.js process, so only trusted upstream services can set them.

Reporter not attributed.

References: [1][2][3][4][5]

Related research