OpenTelemetry JS Prometheus exporter: a malformed request URI crashes the whole Node.js process

Impact

The exporter's metrics endpoint - by default listening on 0.0.0.0:9464 - parses the request URL with no error handling, so a single request with an invalid URI raises an uncaught TypeError and terminates the Node.js process. It is not just the metrics server that dies: the entire service hosting the exporter goes with it, which is why this rates a straight remote availability kill with no authentication. On a fleet, anything scraped by Prometheus is generally reachable from the cluster network, so any tenant pod or anyone on the monitoring path can kill Node-based control-plane services, gateways or serving sidecars repeatedly, and a supervisor that restarts them just gets killed again.

Who can reach it

Anyone with network reach to the exporter's metrics port (default 0.0.0.0:9464). No authentication is required - the endpoint has none.

What to do

Upgrade @opentelemetry/exporter-prometheus (and any bundling package such as sdk-node or auto-instrumentations-node) to 0.217.0 or later and restart each affected service. Until the rebuild lands, bind the exporter to localhost or restrict port 9464 with a NetworkPolicy or firewall rule so only the Prometheus scraper can reach it.

References

Related entries

• rclone (local backend, --links): When rclone copies from an untrusted remote with --links, it recreates symlinksCVE-2026-54572 · rclone (local backend, --links)High
• Jenkins Script Security Plugin: Groovy sandbox escape via AST annotation extensions memberCVE-2026-57281 · Jenkins Script Security Plugin (Groovy sandbox, AST transformation annotations)High
• GitLab CE/EE: improper input validation lets an unauthenticated user cause a denial of serviceCVE-2026-7427 · GitLab CE/EE (unauthenticated request path, improper input validation)High
• Splunk Enterprise Edge Processor sidecar: Prometheus metrics endpoint served without authenticationCVE-2026-76262 · Splunk Enterprise Edge Processor SPL2 Preview sidecar (Prometheus metrics endpoint)High
• ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worseCVE-2020-13817 · ntpd (transmit timestamp prediction)High
• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High