fix(deps): update dependency @opentelemetry/auto-instrumentations-node to v0.75.0 [security] - #22932
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
…e to v0.75.0 [security] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Contributor
Author
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.73.0→0.75.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Prometheus exporter process crash via malformed HTTP request
CVE-2026-44902 / GHSA-q7rr-3cgh-j5r3
More information
Details
Summary
A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default
0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaughtTypeErrorthat terminates the process.You are affected by this vulnerability if either of the following apply to your application:
@opentelemetry/exporter-prometheusin your code through its built-in server.OTEL_METRICS_EXPORTERenvironment variable includesprometheusAND@opentelemetry/sdk-node@opentelemetry/auto-instrumentations-nodevia--require @opentelemetry/auto-instrumentations-node/register/--import @opentelemetry/auto-instrumentations-node/registerImpact
Denial of service. Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.
Remediation
Update to the fixed version
Update
@opentelemetry/exporter-prometheusand@opentelemetry/sdk-nodeto version 0.217.0 or later.Update
@opentelemetry/auto-instrumentations-nodeto version 0.75.0 or later.This release adds proper error handling around the URL constructor, returning an HTTP
400response on parse failure rather than allowing the exception to propagate and crash the process.Do Not Expose the Endpoint to Untrusted Users
If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:
Bind to localhost only by setting the
hostoption to127.0.0.1when configuring thePrometheusExporter, so the port is not exposed on public or shared network interfacesUse a firewall or network policy to restrict access to port
9464(or whichever port you have configured) to only trusted Prometheus scrape hostsPlace the endpoint behind a reverse proxy that filters or validates incoming requests before they reach the exporter
Details
In
PrometheusExporter.ts, the_requestHandlercallsnew URL(request.url, this._baseUrl)without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g.http://) for proxy compatibility, including malformed ones. Whenrequest.urlis"http://", theURLconstructor throwsTypeError: Invalid URL. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to
0.0.0.0by default, meaning it is reachable by any network client that can connect to the metrics port.Proof of Concept
Start any Node.js application with the Prometheus exporter running on the default port
9464, then send a single raw TCP packet:The process crashes immediately with:
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
open-telemetry/opentelemetry-js-contrib (@opentelemetry/auto-instrumentations-node)
v0.75.0Compare Source
Features
Dependencies
v0.74.0Compare Source
Features
Dependencies
v0.73.0Compare Source
Features
Dependencies
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.