0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.2580522, <=0.1.0) +2184 more potentially affected by CVE-2026-59892 via @opentelemetry/propagator-jaeger (>=2.0.0, <=2.8.0)

@opentelemetry/propagator-jaeger NPM version =2.0.0, =0.1.0, =0.1.0-dev.2580522, =0.1.1, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4-0, =1.9.0-1 and more Source cves: CVE-2026-59892 Source...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.2580522, <=0.1.0) +2184 more potentially affected by CVE-2026-59892 via @opentelemetry/propagator-jaeger (>=2.0.0, <=2.8.0)

@opentelemetry/propagator-jaeger NPM version =2.0.0, =0.1.0, =0.1.0-dev.2580522, =0.1.1, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4-0, =1.9.0-1 and more Source cves: CVE-2026-59892 Source...

CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...