fix: bump @opentelemetry/propagator-jaeger to 2.9.0 (CVE-2026-59892)

[Copilot]

@opentelemetry/propagator-jaeger ≤2.7.1 throws an uncaught URIError on malformed percent-encoded uber-trace-id/uberctx-* headers, allowing unauthenticated DoS with a single request.

Changes

• package.json — added npm override "@opentelemetry/propagator-jaeger": "2.9.0"; bumped existing "@opentelemetry/core" override 2.8.0 → 2.9.0 (required by propagator-jaeger 2.9.0)
• package-lock.json — regenerated via npm install

An override is required because @opentelemetry/sdk-node@0.218.0 pins the transitive dep at the exact vulnerable version 2.7.1.

Reachability

Not reachable (high confidence). The CVE only triggers when JaegerPropagator is the active propagator (OTEL_PROPAGATORS=jaeger or setGlobalPropagator(new JaegerPropagator())). Neither configuration appears anywhere in this codebase; the package is present solely as an unexercised transitive dep. This is a scanner-hygiene fix.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header</alert_title>
<alert_description>## Summary

@opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %) in an uber-trace-id or uberctx-* header throws an uncaught URIError, terminating any Node.js process that uses JaegerPropagator as its active propagator.

Impact

Denial of Service: Any unauthenticated remote attacker who can send an HTTP request to a service that has JaegerPropagator registered as the global propagator (e.g. via OTEL_PROPAGATORS=jaeger or propagation.setGlobalPropagator(new JaegerPropagator())) can terminate the process with a single request. Confidentiality and integrity are not affected.

Am I affected?

This issue affects only a specific, opt-in configuration. If you use OpenTelemetry's default propagators (W3C TraceContext and Baggage), you are not affected.

You are affected only if you have registered JaegerPropagator as the active propagator. Check for:

• @opentelemetry/propagator-jaeger in your dependency tree, and
• OTEL_PROPAGATORS set to jaeger (Jaeger only), or a direct propagation.setGlobalPropagator(new JaegerPropagator()) call in your code.

Note: if JaegerPropagator is combined with other propagators through a CompositePropagator (for example OTEL_PROPAGATORS=jaeger,tracecontext), the process does not terminate - the composite propagator catches the error - but affected requests silently fail to extract context. You should still upgrade.

Patched versions

• @opentelemetry/propagator-jaeger 2.9.0

Remediation

Update @opentelemetry/propagator-jaeger to 2.9.0 or later. The propagator now ignores header values it cannot decode instead of throwing.

Interim mitigation (if you cannot update): Trace-context headers should never be accepted unfiltered from untrusted callers. Until you can upgrade, strip or validate the uber-trace-id and uberctx-* headers on inbound requests at your edge - for example with a reverse proxy, API gateway, or load balancer (nginx, Envoy, etc.) - so that only trusted upstream services can set them.

Details

JaegerPropagator.extract() calls decodeURIComponent() on raw header values at two unguarded call sites: the uber-trace-id trace header and each uberctx-* baggage value. decodeURIComponent() throws URIError: URI malformed on invalid percent-encoding. Because the HTTP instrumentation extracts context before its request-handler error wrapper, and a single configured propagator is not wrapped in a CompositePropagator (which would otherwise catch the error), the exception propagates as an uncaughtException and terminates the process.

Proof of concept

Against a service using JaegerPropagator:

curl -H 'uberctx-user: %' http://target/
# or
curl -H 'uber-trace-id: %' http://target/

The Node.js process exits with URIError: URI malformed and subsequent requests are refused.</alert_description>

high
GHSA-45rx-2jwx-cxfr, CVE-2026-59892
@opentelemetry/propagator-jaeger
npm
<vulnerable_versions>2.7.1</vulnerable_versions>
<patched_version>2.9.0</patched_version>
<manifest_path>package-lock.json</manifest_path>

https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr https://nvd.nist.gov/vuln/detail/CVE-2026-59892 https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88 https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0 https://github.com/advisories/GHSA-45rx-2jwx-cxfr

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'impr...

• Resolves github/copilot-survey-engine alert Patch transitive brace-expansion DoS vuln to 1.1.16 via npm override #60

[Copilot]

Pull request overview

Updates the transitive Jaeger propagator to remediate CVE-2026-59892; the vulnerable path is not configured in this codebase.

Changes:

• Overrides Jaeger propagator and OpenTelemetry core at patched version 2.9.0.
• Regenerates the dependency lockfile accordingly.

Show a summary per file

File	Description
package.json	Adds patched OpenTelemetry overrides.
package-lock.json	Locks both packages at 2.9.0.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Medium