Most recent entries from all

CLEANSTART-2026-SG26208 — Security fix for CVE-2026-59892 applied in: n8n 2.28.0-r2, pulumi 3.248.0-r0

2026-10-03T02:36:18.037737+00:00

Affected: CleanStart: n8n, CleanStart: pulumi

CVE-2026-59892 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-334051

2026-10-03T02:36:18.037790+00:00

EUVD-2026-334051

fkie_cve-2026-59892

2026-10-03T02:36:18.037807+00:00

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

GHSA-45rx-2jwx-cxfr — OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

2026-10-03T02:36:18.037831+00:00

Affected: npm: @opentelemetry/propagator-jaeger

## Summary

`@opentelemetry/propagator-jaeger` decodes incoming HTTP header values with `decodeURIComponent()` without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare `%`) in an `uber-trace-id` or `uberctx-*` header throws an uncaught `URIError`, terminating any Node.js process that uses `JaegerPropagator` as its active propagator.

## Impact

**Denial of Service:** Any unauthenticated remote attacker who can send an HTTP request to a service that has `JaegerPropagator` registered as the global propagator (e.g. via `OTEL_PROPAGATORS=jaeger` or `propagation.setGlobalPropagator(new JaegerPropagator())`) can terminate the process with a single request. Confidentiality and integrity are not affected.

## Am I affected?

This issue affects only a specific, opt-in configuration. If you use OpenTelemetry's default propagators (W3C TraceContext and Baggage), you are **not** affected.

You are affected only if you have registered `JaegerPropagator` as the active propagator. Check for:

- `@opentelemetry/propagator-jaeger` in your dependency tree, **and** - `OTEL_PROPAGATORS` set to `jaeger` (Jaeger only), **or** a direct `propagation.setGlobalPropagator(new JaegerPropagator())` call in your code.

Note: if `JaegerPropagator` is combined with other propagators through a `CompositePropagator` (for example `OTEL_PROPAGATORS=jaeger,tracecontext`), the process does not terminate - the composite propagator catches the error…

RHSA-2026:49642 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.

2026-10-03T02:36:18.037875+00:00

multer: Multer: Denial of Service via aborted or malformed multipart uploads multer: Multer: Denial of Service via deeply nested field names in multipart form data brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header protobufjs: protobufjs: Denial of Service via crafted JSON descriptors js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution js-yaml: js-yaml: Denial of Service via crafted YAML documents protobufjs: protobufjs: Denial of Service via crafted .proto schema @opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding