chore(deps): update dependency @opentelemetry/sdk-node to v0.217.0 [security] by renovate[bot] · Pull Request #1375 · launchdarkly/js-core

renovate · 2026-05-12T09:35:58Z

This PR contains the following updates:

Package	Change	Age	Confidence
@opentelemetry/sdk-node (source)	`0.49.1` → `0.217.0`

Prometheus exporter process crash via malformed HTTP request

CVE-2026-44902 / GHSA-q7rr-3cgh-j5r3

More information

Details

Summary

A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process.

You are affected by this vulnerability if either of the following apply to your application:

you directly use @opentelemetry/exporter-prometheus in your code through its built-in server.
your OTEL_METRICS_EXPORTER environment variable includes prometheus AND
- you use @opentelemetry/sdk-node
- you use @opentelemetry/auto-instrumentations-node via --require @opentelemetry/auto-instrumentations-node/register/--import @opentelemetry/auto-instrumentations-node/register

Impact

Denial of service. Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.

Remediation

Update to the fixed version

Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to version 0.217.0 or later.
Update @opentelemetry/auto-instrumentations-node to version 0.75.0 or later.

This release adds proper error handling around the URL constructor, returning an HTTP 400 response on parse failure rather than allowing the exception to propagate and crash the process.

npm install @&#8203;opentelemetry/exporter-prometheus@latest

Do Not Expose the Endpoint to Untrusted Users

[!IMPORTANT]
The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that can reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to 0.217.0 is the recommended resolution.

If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:

Bind to localhost only by setting the host option to 127.0.0.1 when configuring the PrometheusExporter, so the port is not exposed on public or shared network interfaces
Use a firewall or network policy to restrict access to port 9464 (or whichever port you have configured) to only trusted Prometheus scrape hosts
Place the endpoint behind a reverse proxy that filters or validates incoming requests before they reach the exporter

Details

In PrometheusExporter.ts, the _requestHandler calls new URL(request.url, this._baseUrl) without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. http://) for proxy compatibility, including malformed ones. When request.url is "http://", the URL constructor throws TypeError: Invalid URL. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.

The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to 0.0.0.0 by default, meaning it is reachable by any network client that can connect to the metrics port.

Proof of Concept

Start any Node.js application with the Prometheus exporter running on the default port 9464, then send a single raw TCP packet:

echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464

The process crashes immediately with:

TypeError: Invalid URL
    at new URL (...)
    at PrometheusExporter._requestHandler (...)

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-js (@opentelemetry/sdk-node)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Note

Medium Risk
Large OpenTelemetry version bumps can change SDK/runtime behavior and may subtly affect tracing initialization or test expectations, though the code changes are limited to dev/test configuration.

Overview
Updates OpenTelemetry dev dependencies in @launchdarkly/node-server-sdk-otel (@opentelemetry/sdk-node to 0.217.0 and @opentelemetry/sdk-trace-node to 2.7.1).

Adjusts TracingHook.test.ts to disable NodeSDK resource auto-detection (autoDetectResources: false) so spans are exported synchronously under the newer SimpleSpanProcessor behavior.

^{Reviewed by Cursor Bugbot for commit 10fa937. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-05-12T09:37:28Z

@launchdarkly/js-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 26389 bytes
Compressed size limit: 29000
Uncompressed size: 129320 bytes

github-actions · 2026-05-12T09:37:50Z

@launchdarkly/js-client-sdk size report
This is the brotli compressed size of the ESM build.
Compressed size: 31885 bytes
Compressed size limit: 34000
Uncompressed size: 113699 bytes

github-actions · 2026-05-12T09:37:57Z

@launchdarkly/js-client-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 38487 bytes
Compressed size limit: 39000
Uncompressed size: 211236 bytes

github-actions · 2026-05-12T09:38:01Z

@launchdarkly/browser size report
This is the brotli compressed size of the ESM build.
Compressed size: 179499 bytes
Compressed size limit: 200000
Uncompressed size: 830878 bytes

…ecurity]

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

renovate · 2026-05-21T16:10:11Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate Bot requested a review from a team as a code owner May 12, 2026 09:35

This comment was marked as resolved.

Sign in to view

renovate Bot force-pushed the renovate/npm-opentelemetry-sdk-node-vulnerability branch 13 times, most recently from b33d00b to 100fe8f Compare May 19, 2026 05:26

renovate Bot force-pushed the renovate/npm-opentelemetry-sdk-node-vulnerability branch 4 times, most recently from f2ceaa3 to aa211c4 Compare May 20, 2026 15:24

chore(deps): update dependency @opentelemetry/sdk-node to v0.217.0 [s…

d2bb5a7

…ecurity]

renovate Bot force-pushed the renovate/npm-opentelemetry-sdk-node-vulnerability branch from aa211c4 to d2bb5a7 Compare May 21, 2026 14:59

test: fix tests

10fa937

devin-ai-integration Bot reviewed May 21, 2026

View reviewed changes

joker23 approved these changes May 21, 2026

View reviewed changes

joker23 merged commit 7c73024 into main May 21, 2026
45 checks passed

joker23 deleted the renovate/npm-opentelemetry-sdk-node-vulnerability branch May 21, 2026 16:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @opentelemetry/sdk-node to v0.217.0 [security]#1375

chore(deps): update dependency @opentelemetry/sdk-node to v0.217.0 [security]#1375
joker23 merged 2 commits into
mainfrom
renovate/npm-opentelemetry-sdk-node-vulnerability

renovate Bot commented May 12, 2026 •

edited by cursor Bot

Loading

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

renovate Bot commented May 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 12, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Prometheus exporter process crash via malformed HTTP request

Details

Summary

Impact

Remediation

Update to the fixed version

Do Not Expose the Endpoint to Untrusted Users

Details

Proof of Concept

Severity

References

Release Notes

Configuration

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

renovate Bot commented May 21, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 12, 2026 •

edited by cursor Bot

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading