From ac6d0d35afac16b26286bc228ee921688e829d4e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 16:21:10 +0800
Subject: [PATCH] chore: bump up @opentelemetry/exporter-prometheus version to
^0.217.0 [SECURITY] (#14944)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@opentelemetry/exporter-prometheus](https://redirect.github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-prometheus)
([source](https://redirect.github.com/open-telemetry/opentelemetry-js))
| [`^0.215.0` →
`^0.217.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2fexporter-prometheus/0.215.0/0.217.0)
|

|

|
---
### Prometheus exporter process crash via malformed HTTP request
[CVE-2026-44902](https://nvd.nist.gov/vuln/detail/CVE-2026-44902) /
[GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
More information
#### Details
##### Summary
A single malformed HTTP request crashes any Node.js process running the
OpenTelemetry JS Prometheus exporter. The metrics endpoint (default
`0.0.0.0:9464`) has no error handling around URL parsing, so a request
with an invalid URI causes an uncaught `TypeError` that terminates the
process.
**You are affected by this vulnerability if either of the following
apply to your application:**
* you directly use `@opentelemetry/exporter-prometheus` in your code
through its built-in server.
* your `OTEL_METRICS_EXPORTER` environment variable includes
`prometheus` **AND**
* you use `@opentelemetry/sdk-node`
* you use `@opentelemetry/auto-instrumentations-node` via `--require
@opentelemetry/auto-instrumentations-node/register`/`--import
@opentelemetry/auto-instrumentations-node/register`
##### Impact
**Denial of service.** Any application using the OpenTelemetry
Prometheus exporter’s built-in server can be crashed by a single
unauthenticated network packet sent to the metrics port. No
authentication, special privileges, or prior access is required.
##### Remediation
##### Update to the fixed version
Update `@opentelemetry/exporter-prometheus` and
`@opentelemetry/sdk-node` to version **0.217.0** or later.
Update `@opentelemetry/auto-instrumentations-node` to version **0.75.0**
or later.
This release adds proper error handling around the URL constructor,
returning an HTTP `400` response on parse failure rather than allowing
the exception to propagate and crash the process.
```
npm install @opentelemetry/exporter-prometheus@latest
```
##### Do Not Expose the Endpoint to Untrusted Users
> [!IMPORTANT]
> The following mitigations reduce exposure but do not fully remediate
the vulnerability. Any client that *can* reach the metrics endpoint -
including your own Prometheus scraper host if compromised - could still
trigger the crash. Updating to **0.217.0** is the recommended
resolution.
If updating is not immediately feasible, restrict access to the metrics
endpoint so that it is not reachable by untrusted or unauthenticated
network clients. For example:
* **Bind to localhost only** by setting the `host` option to `127.0.0.1`
when configuring the `PrometheusExporter`, so the port is not exposed on
public or shared network interfaces
* **Use a firewall or network policy** to restrict access to port `9464`
(or whichever port you have configured) to only trusted Prometheus
scrape hosts
* **Place the endpoint behind a reverse proxy** that filters or
validates incoming requests before they reach the exporter
##### Details
In `PrometheusExporter.ts`, the `_requestHandler` calls `new
URL(request.url, this._baseUrl)` without any error handling. Node's HTTP
parser accepts absolute-form URIs (e.g. `http://`) for proxy
compatibility, including malformed ones. When `request.url` is
`"http://"`, the `URL` constructor throws `TypeError: Invalid URL`.
Since there is no try-catch in the handler, the exception propagates as
an uncaught exception and crashes the process.
The Prometheus metrics endpoint is unauthenticated by design (Prometheus
scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable
by any network client that can connect to the metrics port.
##### Proof of Concept
Start any Node.js application with the Prometheus exporter running on
the default port `9464`, then send a single raw TCP packet:
```
echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464
```
The process crashes immediately with:
```
TypeError: Invalid URL
at new URL (...)
at PrometheusExporter._requestHandler (...)
```
#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
#### References
-
[https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3)
-
[https://github.com/advisories/GHSA-q7rr-3cgh-j5r3](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-q7rr-3cgh-j5r3)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
---
### Release Notes
open-telemetry/opentelemetry-js
(@opentelemetry/exporter-prometheus)
###
[`v0.217.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7...74cde1b674508ccc0ed2601ac43a80ff2d35114c)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7...74cde1b674508ccc0ed2601ac43a80ff2d35114c)
###
[`v0.216.0`](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8...2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7)
[Compare
Source](https://redirect.github.com/open-telemetry/opentelemetry-js/compare/a0476eef3cb973bfcc0c2e41f868dd7b484c2ed8...2400d8389a4469f7a81ccd3be2f0b2c2dd6faaf7)
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/toeverything/AFFiNE).
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
packages/backend/server/package.json | 2 +-
yarn.lock | 59 +++++++++++++++++++++++++---
2 files changed, 55 insertions(+), 6 deletions(-)
diff --git a/packages/backend/server/package.json b/packages/backend/server/package.json
index ce49d6699e..d8f013ae36 100644
--- a/packages/backend/server/package.json
+++ b/packages/backend/server/package.json
@@ -46,7 +46,7 @@
"@node-rs/crc32": "^1.10.6",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/core": "^2.2.0",
- "@opentelemetry/exporter-prometheus": "^0.215.0",
+ "@opentelemetry/exporter-prometheus": "^0.217.0",
"@opentelemetry/exporter-zipkin": "^2.6.0",
"@opentelemetry/host-metrics": "^0.38.3",
"@opentelemetry/instrumentation": "^0.215.0",
diff --git a/yarn.lock b/yarn.lock
index 37a36f7ad8..3e23ed8c51 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -955,7 +955,7 @@ __metadata:
"@node-rs/crc32": "npm:^1.10.6"
"@opentelemetry/api": "npm:^1.9.0"
"@opentelemetry/core": "npm:^2.2.0"
- "@opentelemetry/exporter-prometheus": "npm:^0.215.0"
+ "@opentelemetry/exporter-prometheus": "npm:^0.217.0"
"@opentelemetry/exporter-zipkin": "npm:^2.6.0"
"@opentelemetry/host-metrics": "npm:^0.38.3"
"@opentelemetry/instrumentation": "npm:^0.215.0"
@@ -9750,7 +9750,7 @@ __metadata:
languageName: node
linkType: hard
-"@opentelemetry/core@npm:2.7.0, @opentelemetry/core@npm:^2.0.0, @opentelemetry/core@npm:^2.2.0, @opentelemetry/core@npm:^2.5.1":
+"@opentelemetry/core@npm:2.7.0":
version: 2.7.0
resolution: "@opentelemetry/core@npm:2.7.0"
dependencies:
@@ -9761,6 +9761,17 @@ __metadata:
languageName: node
linkType: hard
+"@opentelemetry/core@npm:2.7.1, @opentelemetry/core@npm:^2.0.0, @opentelemetry/core@npm:^2.2.0, @opentelemetry/core@npm:^2.5.1":
+ version: 2.7.1
+ resolution: "@opentelemetry/core@npm:2.7.1"
+ dependencies:
+ "@opentelemetry/semantic-conventions": "npm:^1.29.0"
+ peerDependencies:
+ "@opentelemetry/api": ">=1.0.0 <1.10.0"
+ checksum: 10/aaec929e1f22b3704e3cb195f8a27b2d9bd0292a565741c00b1e8cde0f3043de41713632fe15e4bfd588d83807a5b10a861deffad173e28787802ede9123ced7
+ languageName: node
+ linkType: hard
+
"@opentelemetry/exporter-logs-otlp-grpc@npm:0.215.0":
version: 0.215.0
resolution: "@opentelemetry/exporter-logs-otlp-grpc@npm:0.215.0"
@@ -9858,7 +9869,7 @@ __metadata:
languageName: node
linkType: hard
-"@opentelemetry/exporter-prometheus@npm:0.215.0, @opentelemetry/exporter-prometheus@npm:^0.215.0":
+"@opentelemetry/exporter-prometheus@npm:0.215.0":
version: 0.215.0
resolution: "@opentelemetry/exporter-prometheus@npm:0.215.0"
dependencies:
@@ -9872,6 +9883,20 @@ __metadata:
languageName: node
linkType: hard
+"@opentelemetry/exporter-prometheus@npm:^0.217.0":
+ version: 0.217.0
+ resolution: "@opentelemetry/exporter-prometheus@npm:0.217.0"
+ dependencies:
+ "@opentelemetry/core": "npm:2.7.1"
+ "@opentelemetry/resources": "npm:2.7.1"
+ "@opentelemetry/sdk-metrics": "npm:2.7.1"
+ "@opentelemetry/semantic-conventions": "npm:^1.29.0"
+ peerDependencies:
+ "@opentelemetry/api": ^1.3.0
+ checksum: 10/cc1b01d902659a8d438e2e9768821a4a25ad4df34d8ac68107784255caed1f6c64e5b239f0e70ec05d4f8cf0222369cf29baf926974d67383117402870e0d69a
+ languageName: node
+ linkType: hard
+
"@opentelemetry/exporter-trace-otlp-grpc@npm:0.215.0":
version: 0.215.0
resolution: "@opentelemetry/exporter-trace-otlp-grpc@npm:0.215.0"
@@ -10408,7 +10433,7 @@ __metadata:
languageName: node
linkType: hard
-"@opentelemetry/resources@npm:2.7.0, @opentelemetry/resources@npm:^2.2.0, @opentelemetry/resources@npm:^2.5.1":
+"@opentelemetry/resources@npm:2.7.0":
version: 2.7.0
resolution: "@opentelemetry/resources@npm:2.7.0"
dependencies:
@@ -10420,6 +10445,18 @@ __metadata:
languageName: node
linkType: hard
+"@opentelemetry/resources@npm:2.7.1, @opentelemetry/resources@npm:^2.2.0, @opentelemetry/resources@npm:^2.5.1":
+ version: 2.7.1
+ resolution: "@opentelemetry/resources@npm:2.7.1"
+ dependencies:
+ "@opentelemetry/core": "npm:2.7.1"
+ "@opentelemetry/semantic-conventions": "npm:^1.29.0"
+ peerDependencies:
+ "@opentelemetry/api": ">=1.3.0 <1.10.0"
+ checksum: 10/4df7abc021df99c5716deb18b2a528245e7da2116daefcfb25508b3d198de8923ca245da1a1cb3b83ae28bf24ab2cc0e73480f0f0e0fb9fddd79b96b2484d002
+ languageName: node
+ linkType: hard
+
"@opentelemetry/sdk-logs@npm:0.215.0":
version: 0.215.0
resolution: "@opentelemetry/sdk-logs@npm:0.215.0"
@@ -10434,7 +10471,7 @@ __metadata:
languageName: node
linkType: hard
-"@opentelemetry/sdk-metrics@npm:2.7.0, @opentelemetry/sdk-metrics@npm:^2.2.0":
+"@opentelemetry/sdk-metrics@npm:2.7.0":
version: 2.7.0
resolution: "@opentelemetry/sdk-metrics@npm:2.7.0"
dependencies:
@@ -10446,6 +10483,18 @@ __metadata:
languageName: node
linkType: hard
+"@opentelemetry/sdk-metrics@npm:2.7.1, @opentelemetry/sdk-metrics@npm:^2.2.0":
+ version: 2.7.1
+ resolution: "@opentelemetry/sdk-metrics@npm:2.7.1"
+ dependencies:
+ "@opentelemetry/core": "npm:2.7.1"
+ "@opentelemetry/resources": "npm:2.7.1"
+ peerDependencies:
+ "@opentelemetry/api": ">=1.9.0 <1.10.0"
+ checksum: 10/884b1be10c285143c52b3910f203562b738064bca8a55a5a71e8ca3acf9775ce194f3f9444a1f8cd1669b32425d0e753e0cee09fbb68b329332f2e824b06653c
+ languageName: node
+ linkType: hard
+
"@opentelemetry/sdk-node@npm:^0.215.0":
version: 0.215.0
resolution: "@opentelemetry/sdk-node@npm:0.215.0"