Malformed HTTP requests are parsed without safeguards in the OpenTelemetry JavaScript Prometheus exporter, causing an uncaught TypeError that terminates the Node.js process. This crash results in a denial‑of‑service condition, exposing the application to availability disruption.

Vulnerable deployments include the OpenTelemetry JS Auto‑instrumentations for Node, the Prometheus exporter, the SDK for Node, and the overall OpenTelemetry JS client, all in versions prior to 0.217.0. These components expose the metrics endpoint on the default 0.0.0.0:9464 interface.

With a CVSS score of 7.5, the exploitability of this flaw depends on an attacker’s ability to send a specially crafted HTTP request to the public metrics endpoint. The absence of an EPSS score only reflects lack of publicly available exploit data, but the fact that the exporter listens on all network interfaces increases the risk of remote exploitation. The vulnerability is not currently listed in the CISA KEV catalog.