Repository navigation
Commit 06c6223
chore(deps): update dependency @opentelemetry/sdk-node to ^0.217.0 [security] (#9511)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@opentelemetry/sdk-node](https://redirect.github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node)
([source](https://redirect.github.com/open-telemetry/opentelemetry-js))
| [`^0.52.0` →
`^0.217.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2fsdk-node/0.52.1/0.217.0)
|

|

|
---
### Prometheus exporter process crash via malformed HTTP request
[CVE-2026-44902](https://nvd.nist.gov/vuln/detail/CVE-2026-44902) /
[GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
<details>
<summary>More information</summary>
#### Details
##### Summary
A single malformed HTTP request crashes any Node.js process running the
OpenTelemetry JS Prometheus exporter. The metrics endpoint (default
`0.0.0.0:9464`) has no error handling around URL parsing, so a request
with an invalid URI causes an uncaught `TypeError` that terminates the
process.
**You are affected by this vulnerability if either of the following
apply to your application:**
* you directly use `@opentelemetry/exporter-prometheus` in your code
through its built-in server.
* your `OTEL_METRICS_EXPORTER` environment variable includes
`prometheus` **AND**
* you use `@opentelemetry/sdk-node`
* you use `@opentelemetry/auto-instrumentations-node` via `--require
@opentelemetry/auto-instrumentations-node/register`/`--import
@opentelemetry/auto-instrumentations-node/register`
##### Impact
**Denial of service.** Any application using the OpenTelemetry
Prometheus exporter’s built-in server can be crashed by a single
unauthenticated network packet sent to the metrics port. No
authentication, special privileges, or prior access is required.
##### Remediation
##### Update to the fixed version
Update `@opentelemetry/exporter-prometheus` and
`@opentelemetry/sdk-node` to version **0.217.0** or later.
Update `@opentelemetry/auto-instrumentations-node` to version **0.75.0**
or later.
This release adds proper error handling around the URL constructor,
returning an HTTP `400` response on parse failure rather than allowing
the exception to propagate and crash the process.
```
npm install @opentelemetry/exporter-prometheus@latest
```
##### Do Not Expose the Endpoint to Untrusted Users
> [!IMPORTANT]
> The following mitigations reduce exposure but do not fully remediate
the vulnerability. Any client that *can* reach the metrics endpoint -
including your own Prometheus scraper host if compromised - could still
trigger the crash. Updating to **0.217.0** is the recommended
resolution.
If updating is not immediately feasible, restrict access to the metrics
endpoint so that it is not reachable by untrusted or unauthenticated
network clients. For example:
* **Bind to localhost only** by setting the `host` option to `127.0.0.1`
when configuring the `PrometheusExporter`, so the port is not exposed on
public or shared network interfaces
* **Use a firewall or network policy** to restrict access to port `9464`
(or whichever port you have configured) to only trusted Prometheus
scrape hosts
* **Place the endpoint behind a reverse proxy** that filters or
validates incoming requests before they reach the exporter
##### Details
In `PrometheusExporter.ts`, the `_requestHandler` calls `new
URL(request.url, this._baseUrl)` without any error handling. Node's HTTP
parser accepts absolute-form URIs (e.g. `http://`) for proxy
compatibility, including malformed ones. When `request.url` is
`"http://"`, the `URL` constructor throws `TypeError: Invalid URL`.
Since there is no try-catch in the handler, the exception propagates as
an uncaught exception and crashes the process.
The Prometheus metrics endpoint is unauthenticated by design (Prometheus
scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable
by any network client that can connect to the metrics port.
##### Proof of Concept
Start any Node.js application with the Prometheus exporter running on
the default port `9464`, then send a single raw TCP packet:
```
echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464
```
The process crashes immediately with:
```
TypeError: Invalid URL
at new URL (...)
at PrometheusExporter._requestHandler (...)
```
#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
#### References
-
[https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-44902](https://nvd.nist.gov/vuln/detail/CVE-2026-44902)
-
[https://github.com/advisories/GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>open-telemetry/opentelemetry-js
(@​opentelemetry/sdk-node)</summary>
###
[`v0.217.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7...74cde1b674508ccc0ed2601ac43a80ff2d35114c)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7...74cde1b674508ccc0ed2601ac43a80ff2d35114c)
###
[`v0.216.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8...2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8...2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7)
###
[`v0.215.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/7e74509a4d848e94b2970bb5262dd3e8efeed0a2...a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/7e74509a4d848e94b2970bb5262dd3e8efeed0a2...a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8)
###
[`v0.214.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/541e1b4ad83ad2093459794a18283228fe58d199...7e74509a4d848e94b2970bb5262dd3e8efeed0a2)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/541e1b4ad83ad2093459794a18283228fe58d199...7e74509a4d848e94b2970bb5262dd3e8efeed0a2)
###
[`v0.213.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/ad92be4c2c1094745a85b0b7eeff1444a11b1b4a...541e1b4ad83ad2093459794a18283228fe58d199)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/ad92be4c2c1094745a85b0b7eeff1444a11b1b4a...541e1b4ad83ad2093459794a18283228fe58d199)
###
[`v0.212.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/38924cbff2a6e924ce8a2a227d3a72de52fbcd35...ad92be4c2c1094745a85b0b7eeff1444a11b1b4a)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/38924cbff2a6e924ce8a2a227d3a72de52fbcd35...ad92be4c2c1094745a85b0b7eeff1444a11b1b4a)
###
[`v0.211.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/5e6504d2a3a7ce3aaa211d9e2a5b002a0e4d7da1...38924cbff2a6e924ce8a2a227d3a72de52fbcd35)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/5e6504d2a3a7ce3aaa211d9e2a5b002a0e4d7da1...38924cbff2a6e924ce8a2a227d3a72de52fbcd35)
###
[`v0.210.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/228cb920bbededf4f3fd6355e88409e84bfd87b6...5e6504d2a3a7ce3aaa211d9e2a5b002a0e4d7da1)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/228cb920bbededf4f3fd6355e88409e84bfd87b6...5e6504d2a3a7ce3aaa211d9e2a5b002a0e4d7da1)
###
[`v0.209.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/5eaa869bf08e6a16eec37eac44084257e8e21209...228cb920bbededf4f3fd6355e88409e84bfd87b6)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/5eaa869bf08e6a16eec37eac44084257e8e21209...228cb920bbededf4f3fd6355e88409e84bfd87b6)
###
[`v0.208.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/fb6476d8243ac8dcaaea74130b9c50c43938275c...5eaa869bf08e6a16eec37eac44084257e8e21209)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/fb6476d8243ac8dcaaea74130b9c50c43938275c...5eaa869bf08e6a16eec37eac44084257e8e21209)
###
[`v0.207.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/8e9b8bb2a7a2d81ae0b5171efdf1644210697fa2...fb6476d8243ac8dcaaea74130b9c50c43938275c)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/8e9b8bb2a7a2d81ae0b5171efdf1644210697fa2...fb6476d8243ac8dcaaea74130b9c50c43938275c)
###
[`v0.206.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2d3760898cdc4f0e68f9f956603cc5df279eb3a8...8e9b8bb2a7a2d81ae0b5171efdf1644210697fa2)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2d3760898cdc4f0e68f9f956603cc5df279eb3a8...8e9b8bb2a7a2d81ae0b5171efdf1644210697fa2)
###
[`v0.205.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/98f9d720af84bc38074dfd4ab7760ae83a3e9826...2d3760898cdc4f0e68f9f956603cc5df279eb3a8)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/98f9d720af84bc38074dfd4ab7760ae83a3e9826...2d3760898cdc4f0e68f9f956603cc5df279eb3a8)
###
[`v0.204.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/93187f022457da152becc03dd00db8b2500702db...98f9d720af84bc38074dfd4ab7760ae83a3e9826)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/93187f022457da152becc03dd00db8b2500702db...98f9d720af84bc38074dfd4ab7760ae83a3e9826)
###
[`v0.203.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/55f8c20b19777602f993328fe07f523cf465dea3...93187f022457da152becc03dd00db8b2500702db)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/55f8c20b19777602f993328fe07f523cf465dea3...93187f022457da152becc03dd00db8b2500702db)
###
[`v0.202.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/9dbd1e446be0ecc7c22b00051c5cfb2612d9b0f2...55f8c20b19777602f993328fe07f523cf465dea3)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/9dbd1e446be0ecc7c22b00051c5cfb2612d9b0f2...55f8c20b19777602f993328fe07f523cf465dea3)
###
[`v0.201.1`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/4ce5bd165195870f292fa95e312cffe05eb9e09d...9dbd1e446be0ecc7c22b00051c5cfb2612d9b0f2)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/4ce5bd165195870f292fa95e312cffe05eb9e09d...9dbd1e446be0ecc7c22b00051c5cfb2612d9b0f2)
###
[`v0.201.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/7fde94081ed141c7d61db269b77d5765887a9665...4ce5bd165195870f292fa95e312cffe05eb9e09d)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/7fde94081ed141c7d61db269b77d5765887a9665...4ce5bd165195870f292fa95e312cffe05eb9e09d)
###
[`v0.200.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/ac8641a5dbb5df1169bd5ed25a6667a6a6f730ca...7fde94081ed141c7d61db269b77d5765887a9665)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/ac8641a5dbb5df1169bd5ed25a6667a6a6f730ca...7fde94081ed141c7d61db269b77d5765887a9665)
###
[`v0.57.2`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/cbc912d67bda462ca00449d7ce7b80052c20a4fc...ac8641a5dbb5df1169bd5ed25a6667a6a6f730ca)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/cbc912d67bda462ca00449d7ce7b80052c20a4fc...ac8641a5dbb5df1169bd5ed25a6667a6a6f730ca)
###
[`v0.57.1`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156...cbc912d67bda462ca00449d7ce7b80052c20a4fc)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156...cbc912d67bda462ca00449d7ce7b80052c20a4fc)
###
[`v0.57.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/85dcbc7c55f002837f1bf1bf01145dbb34a55b40...616d27a0a111c9b813d14c56d8d8f1ffbd7d7156)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/85dcbc7c55f002837f1bf1bf01145dbb34a55b40...616d27a0a111c9b813d14c56d8d8f1ffbd7d7156)
###
[`v0.56.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/4b1ad3fda0cde58907e30fab25c3c767546708e5...85dcbc7c55f002837f1bf1bf01145dbb34a55b40)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/4b1ad3fda0cde58907e30fab25c3c767546708e5...85dcbc7c55f002837f1bf1bf01145dbb34a55b40)
###
[`v0.55.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/72c9af91983e4b7aade98c901bd45c6cefee0da4...4b1ad3fda0cde58907e30fab25c3c767546708e5)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/72c9af91983e4b7aade98c901bd45c6cefee0da4...4b1ad3fda0cde58907e30fab25c3c767546708e5)
###
[`v0.54.2`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/6f4f3fcefd8e453f0516ba15fe0c2580442dd06a...72c9af91983e4b7aade98c901bd45c6cefee0da4)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/6f4f3fcefd8e453f0516ba15fe0c2580442dd06a...72c9af91983e4b7aade98c901bd45c6cefee0da4)
###
[`v0.54.1`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/eb3ca4fb07ee31c62093f5fcec56575573c902ce...6f4f3fcefd8e453f0516ba15fe0c2580442dd06a)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/eb3ca4fb07ee31c62093f5fcec56575573c902ce...6f4f3fcefd8e453f0516ba15fe0c2580442dd06a)
###
[`v0.54.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/720bc8c70d47029cb6b41a34ffdc3d25cbaa2f80...eb3ca4fb07ee31c62093f5fcec56575573c902ce)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/720bc8c70d47029cb6b41a34ffdc3d25cbaa2f80...eb3ca4fb07ee31c62093f5fcec56575573c902ce)
###
[`v0.53.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/0608f405573901e54db01e44c533009cf28be262...720bc8c70d47029cb6b41a34ffdc3d25cbaa2f80)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/0608f405573901e54db01e44c533009cf28be262...720bc8c70d47029cb6b41a34ffdc3d25cbaa2f80)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/google-cloud-node).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Co-authored-by: Daniel Bruce <djbruce@google.com>1 parent 2a34528 commit 06c6223
5 files changed
Lines changed: 391 additions & 316 deletions
File tree
- handwritten/logging
- system-test
- test
- utils
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
65 | 65 | | |
66 | 66 | | |
67 | 67 | | |
68 | | - | |
| 68 | + | |
69 | 69 | | |
70 | 70 | | |
71 | 71 | | |
72 | | - | |
73 | | - | |
74 | | - | |
75 | | - | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
76 | 76 | | |
77 | 77 | | |
78 | 78 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
33 | | - | |
| 33 | + | |
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
| |||
792 | 792 | | |
793 | 793 | | |
794 | 794 | | |
795 | | - | |
| 795 | + | |
796 | 796 | | |
797 | 797 | | |
798 | 798 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
21 | 21 | | |
22 | 22 | | |
23 | 23 | | |
24 | | - | |
| 24 | + | |
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
| |||
315 | 315 | | |
316 | 316 | | |
317 | 317 | | |
318 | | - | |
| 318 | + | |
319 | 319 | | |
320 | 320 | | |
321 | 321 | | |
| |||
493 | 493 | | |
494 | 494 | | |
495 | 495 | | |
496 | | - | |
| 496 | + | |
497 | 497 | | |
498 | 498 | | |
499 | 499 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
28 | | - | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
106 | 106 | | |
107 | 107 | | |
108 | 108 | | |
109 | | - | |
| 109 | + | |
110 | 110 | | |
111 | 111 | | |
112 | 112 | | |
| |||
323 | 323 | | |
324 | 324 | | |
325 | 325 | | |
326 | | - | |
| 326 | + | |
327 | 327 | | |
328 | 328 | | |
329 | 329 | | |
| |||
0 commit comments