Update npm package `@opentelemetry/sdk-node` to v0.217.0 [SECURITY] by hash-worker[bot] · Pull Request #8739 · hashintel/hash

hash-worker · 2026-05-22T12:24:22Z

This PR contains the following updates:

Package	Change	Age	Confidence
@opentelemetry/sdk-node (source)	`0.207.0` → `0.217.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-44902

Summary

A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process.

You are affected by this vulnerability if either of the following apply to your application:

you directly use @opentelemetry/exporter-prometheus in your code through its built-in server.
your OTEL_METRICS_EXPORTER environment variable includes prometheus AND
- you use @opentelemetry/sdk-node
- you use @opentelemetry/auto-instrumentations-node via --require @opentelemetry/auto-instrumentations-node/register/--import @opentelemetry/auto-instrumentations-node/register

Impact

Denial of service. Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.

Remediation

Update to the fixed version

Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to version 0.217.0 or later.
Update @opentelemetry/auto-instrumentations-node to version 0.75.0 or later.

This release adds proper error handling around the URL constructor, returning an HTTP 400 response on parse failure rather than allowing the exception to propagate and crash the process.

npm install @&#8203;opentelemetry/exporter-prometheus@latest

Do Not Expose the Endpoint to Untrusted Users

Important

The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that can reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to 0.217.0 is the recommended resolution.

If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:

Bind to localhost only by setting the host option to 127.0.0.1 when configuring the PrometheusExporter, so the port is not exposed on public or shared network interfaces
Use a firewall or network policy to restrict access to port 9464 (or whichever port you have configured) to only trusted Prometheus scrape hosts
Place the endpoint behind a reverse proxy that filters or validates incoming requests before they reach the exporter

Details

In PrometheusExporter.ts, the _requestHandler calls new URL(request.url, this._baseUrl) without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. http://) for proxy compatibility, including malformed ones. When request.url is "http://", the URL constructor throws TypeError: Invalid URL. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.

The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to 0.0.0.0 by default, meaning it is reachable by any network client that can connect to the metrics port.

Proof of Concept

Start any Node.js application with the Prometheus exporter running on the default port 9464, then send a single raw TCP packet:

echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464

The process crashes immediately with:

TypeError: Invalid URL
    at new URL (...)
    at PrometheusExporter._requestHandler (...)

Release Notes

open-telemetry/opentelemetry-js (@opentelemetry/sdk-node)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

hash-worker · 2026-05-22T12:24:28Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

error This project's package.json defines "packageManager": "yarn@4.12.0". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

vercel · 2026-05-22T12:24:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Error		May 22, 2026 12:25pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	May 22, 2026 12:25pm
petrinaut	Skipped		May 22, 2026 12:25pm

cursor · 2026-05-22T12:24:30Z

PR Summary

Low Risk
Low risk dependency bump limited to the tests/hash-backend-load package; potential risk is minor runtime behavior changes in OpenTelemetry instrumentation/exporter initialization during load tests.

Overview
Updates @opentelemetry/sdk-node from 0.207.0 to 0.217.0 in the tests/hash-backend-load package to pick up the latest OpenTelemetry Node SDK (including security fixes). No application or test logic changes beyond the dependency version bump.

^{Reviewed by Cursor Bugbot for commit e28affb. Bugbot is set up for automated code reviews on this repo. Configure here.}

augmentcode · 2026-05-22T12:25:40Z

🤖 Augment PR Summary

Summary: Updates the load-test package to use @opentelemetry/sdk-node v0.217.0.

Why: Picks up the security fix called out in the GitHub advisory (CVE-2026-44902) for Prometheus exporter URL parsing crash scenarios.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-05-22T12:25:41Z

    "@opentelemetry/exporter-trace-otlp-grpc": "0.207.0",
    "@opentelemetry/resources": "2.2.0",
-    "@opentelemetry/sdk-node": "0.207.0",
+    "@opentelemetry/sdk-node": "0.217.0",


tests/hash-backend-load/package.json:41 — This bumps @opentelemetry/sdk-node to 0.217.0 while @opentelemetry/exporter-trace-otlp-grpc remains at 0.207.0; since these 0.x OpenTelemetry packages tend to be version-aligned, this can result in duplicate/mismatched internal OTel dependencies and subtle runtime issues. Consider aligning the OpenTelemetry experimental package versions (or double-checking peer/interop compatibility for this combo).

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e28affb. Configure here.}

cursor · 2026-05-22T12:27:42Z

    "@opentelemetry/exporter-trace-otlp-grpc": "0.207.0",
    "@opentelemetry/resources": "2.2.0",
-    "@opentelemetry/sdk-node": "0.207.0",
+    "@opentelemetry/sdk-node": "0.217.0",


OpenTelemetry experimental packages version mismatch after partial upgrade

Medium Severity

@opentelemetry/sdk-node is bumped to 0.217.0 while @opentelemetry/exporter-trace-otlp-grpc remains at 0.207.0. These are experimental packages from the same monorepo released in lockstep and intended to be used at matching versions. The 10-version gap can cause duplicate internal dependency instances (e.g., @opentelemetry/resources at both 2.2.0 and ~2.7.x), potentially breaking context propagation or resource merging in the tracing setup.

Additional Locations (1)

tests/hash-backend-load/package.json#L38-L39

^{Reviewed by Cursor Bugbot for commit e28affb. Configure here.}

Update npm package @opentelemetry/sdk-node to v0.217.0 [SECURITY]

e28affb

hash-worker Bot enabled auto-merge May 22, 2026 12:24

hash-worker Bot assigned TimDiekmann May 22, 2026

github-actions Bot added area/deps Relates to third-party dependencies (area) area/tests New or updated tests labels May 22, 2026

vercel Bot had a problem deploying to Preview – hash May 22, 2026 12:25 Failure

augmentcode Bot reviewed May 22, 2026

View reviewed changes

cursor Bot reviewed May 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update npm package `@opentelemetry/sdk-node` to v0.217.0 [SECURITY]#8739

Update npm package `@opentelemetry/sdk-node` to v0.217.0 [SECURITY]#8739
hash-worker[bot] wants to merge 1 commit into
mainfrom
deps/js/npm-opentelemetry-sdk-node-vulnerability

hash-worker Bot commented May 22, 2026

Uh oh!

hash-worker Bot commented May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 •

edited

Loading

Uh oh!

cursor Bot commented May 22, 2026 •

edited

Loading

Uh oh!

augmentcode Bot commented May 22, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot May 22, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Conversation

hash-worker Bot commented May 22, 2026

GitHub Vulnerability Alerts

Summary

Impact

Remediation

Update to the fixed version

Do Not Expose the Endpoint to Untrusted Users

Details

Proof of Concept

Release Notes

Configuration

Uh oh!

hash-worker Bot commented May 22, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

augmentcode Bot commented May 22, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 22, 2026

Choose a reason for hiding this comment

OpenTelemetry experimental packages version mismatch after partial upgrade

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 22, 2026 •

edited

Loading

cursor Bot commented May 22, 2026 •

edited

Loading

augmentcode Bot May 22, 2026 •

edited

Loading