cve.nowby Sazabi

npmPackage

@opentelemetry/propagator-jaeger

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release: 2.12.0 (Oct 6, 2026): no advisory affects it
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 1 · 1 high

Weekly downloads: 31.2M
Dependents: 199
Releases: 160 since 0.3.3 (Jan 22, 2020)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-59892
Affects 0.3.3 to 2.8.0 (2.9.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

CVE-2026-59892High 7.5
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
Affected: fixed in 2.9.0.
Fixed in 2.9.0 (released Jul 2, 2026, 6 days before disclosure).
The latest release, 2.12.0, is not affected.
52% of @opentelemetry/propagator-jaeger downloads last week were affected versions (16.9M).