chore(deps): update dependency @opentelemetry/sdk-node to v0.217.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opentelemetry/sdk-node (source)	0.49.1 → 0.217.0

---

Prometheus exporter process crash via malformed HTTP request

CVE-2026-44902 / GHSA-q7rr-3cgh-j5r3

More information

Details

Summary

A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process.

You are affected by this vulnerability if either of the following apply to your application:

• you directly use @opentelemetry/exporter-prometheus in your code through its built-in server.
• your OTEL_METRICS_EXPORTER environment variable includes prometheus AND
  • you use @opentelemetry/sdk-node
  • you use @opentelemetry/auto-instrumentations-node via --require @​opentelemetry/auto-instrumentations-node/register/--import @​opentelemetry/auto-instrumentations-node/register

Impact

Denial of service. Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.

Remediation

Update to the fixed version

Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to version 0.217.0 or later.
Update @opentelemetry/auto-instrumentations-node to version 0.75.0 or later.

This release adds proper error handling around the URL constructor, returning an HTTP 400 response on parse failure rather than allowing the exception to propagate and crash the process.

npm install @​opentelemetry/exporter-prometheus@latest

Do Not Expose the Endpoint to Untrusted Users

[!IMPORTANT]
The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that can reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to 0.217.0 is the recommended resolution.

If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:

• Bind to localhost only by setting the host option to 127.0.0.1 when configuring the PrometheusExporter, so the port is not exposed on public or shared network interfaces

• Use a firewall or network policy to restrict access to port 9464 (or whichever port you have configured) to only trusted Prometheus scrape hosts

• Place the endpoint behind a reverse proxy that filters or validates incoming requests before they reach the exporter

Details

In PrometheusExporter.ts, the _requestHandler calls new URL(request.url, this._baseUrl) without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. http://) for proxy compatibility, including malformed ones. When request.url is "http://", the URL constructor throws TypeError: Invalid URL. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.

The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to 0.0.0.0 by default, meaning it is reachable by any network client that can connect to the metrics port.

Proof of Concept

Start any Node.js application with the Prometheus exporter running on the default port 9464, then send a single raw TCP packet:

echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464

The process crashes immediately with:

TypeError: Invalid URL
    at new URL (...)
    at PrometheusExporter._requestHandler (...)

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3
• https://github.com/open-telemetry/opentelemetry-js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-js (@​opentelemetry/sdk-node)

v0.217.0

Compare Source

v0.216.0

Compare Source

v0.215.0

Compare Source

v0.214.0

Compare Source

v0.213.0

Compare Source

v0.212.0

Compare Source

v0.211.0

Compare Source

v0.210.0

Compare Source

v0.209.0

Compare Source

v0.208.0

Compare Source

v0.207.0

Compare Source

v0.206.0

Compare Source

v0.205.0

Compare Source

v0.204.0

Compare Source

v0.203.0

Compare Source

v0.202.0

Compare Source

v0.201.1

Compare Source

v0.201.0

Compare Source

v0.200.0

Compare Source

v0.57.2

Compare Source

v0.57.1

Compare Source

v0.57.0

Compare Source

v0.56.0

Compare Source

v0.55.0

Compare Source

v0.54.2

Compare Source

v0.54.1

Compare Source

v0.54.0

Compare Source

v0.53.0

Compare Source

v0.52.1

Compare Source

v0.52.0

Compare Source

v0.51.1

Compare Source

v0.51.0

Compare Source

v0.50.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

@launchdarkly/js-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 26208 bytes
Compressed size limit: 29000
Uncompressed size: 128789 bytes

[cursor]

Cursor Bugbot has reviewed your changes using default mode and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b95ff8d. Configure here.}

[cursor]

Incompatible OpenTelemetry sdk-trace-node version not updated

High Severity

@opentelemetry/sdk-node was bumped from 0.49.1 to 0.217.0, but @opentelemetry/sdk-trace-node remains at 1.22.0. The new sdk-node 0.217.0 depends on sdk-trace-node 2.7.1 (a major version bump). The test file imports InMemorySpanExporter and SimpleSpanProcessor from sdk-trace-node 1.x and passes them to the NodeSDK constructor from sdk-node 0.217.0, which expects 2.x-compatible types. This version mismatch will likely cause install conflicts and/or test failures.

 

^{Reviewed by Cursor Bugbot for commit b95ff8d. Configure here.}

[github-actions]

@launchdarkly/js-client-sdk size report
This is the brotli compressed size of the ESM build.
Compressed size: 31906 bytes
Compressed size limit: 34000
Uncompressed size: 113658 bytes

[github-actions]

@launchdarkly/js-client-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 38487 bytes
Compressed size limit: 39000
Uncompressed size: 211236 bytes

[github-actions]

@launchdarkly/browser size report
This is the brotli compressed size of the ESM build.
Compressed size: 179498 bytes
Compressed size limit: 200000
Uncompressed size: 830837 bytes