fix(deps): bump @opentelemetry/auto-instrumentations-node to 0.75.0 (CVE-2026-44902)

[Copilot]

@opentelemetry/auto-instrumentations-node <=0.74.x transitively pulls in @opentelemetry/exporter-prometheus <0.217.0, which crashes the Node process on a single malformed HTTP request to the metrics endpoint (uncaught TypeError from new URL() with no try/catch).

Changes

• package.json — bumps @opentelemetry/auto-instrumentations-node ^0.62.1 → ^0.75.0
• bun.lock — regenerated; transitive @opentelemetry/exporter-prometheus now resolves to 0.217.0 (patched) across the full dependency tree; vulnerable 0.203.0 is gone

Reachability

This app uses OTLP metric export (OTLPMetricExporter + PeriodicExportingMetricReader), not the Prometheus built-in server, so the crash path is not reachable under normal configuration. The vulnerable version was still present in the transitive tree and would activate if OTEL_METRICS_EXPORTER=prometheus were ever set.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>Prometheus exporter process crash via malformed HTTP request</alert_title>
<alert_description>## Summary

A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process.

You are affected by this vulnerability if either of the following apply to your application:

• you directly use @opentelemetry/exporter-prometheus in your code through its built-in server.
• your OTEL_METRICS_EXPORTER environment variable includes prometheus AND
  • you use @opentelemetry/sdk-node
  • you use @opentelemetry/auto-instrumentations-node via --require @opentelemetry/auto-instrumentations-node/register/--import @opentelemetry/auto-instrumentations-node/register

Impact

Denial of service. Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.

Remediation

Update to the fixed version

Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to version 0.217.0 or later.
Update @opentelemetry/auto-instrumentations-node to version 0.75.0 or later.

This release adds proper error handling around the URL constructor, returning an HTTP 400 response on parse failure rather than allowing the exception to propagate and crash the process.

npm install @opentelemetry/exporter-prometheus@latest

Do Not Expose the Endpoint to Untrusted Users

[!IMPORTANT]
The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that can reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to 0.217.0 is the recommended resolution.

If updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:

• Bind to localhost only by setting the host option to 127.0.0.1 when configuring the PrometheusExporter, so the port is not exposed on public or shared network interfaces

• Use a firewall or network policy to restrict access to port 9464 (or whichever port you have configured) to only trusted Prometheus scrape hosts

• Place the endpoint behind a reverse proxy that filters or validates incoming requests before they reach the exporter

Details

In PrometheusExporter.ts, the _requestHandler calls new URL(request.url, this._baseUrl) without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. http://) for proxy compatibility, including malformed ones. When request.url is "http://", the URL constructor throws TypeError: Invalid URL. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.

The Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to 0.0.0.0 by default, meaning it is reachable by any network client that can connect to the metrics port.

Proof of Concept

Start any Node.js application with the Prometheus exporter running on the default port 9464, then send a single raw TCP packet:

echo -ne 'GET http:// HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 9464

The process crashes immediately with:

TypeError: Invalid URL
    at new URL (...)
    at PrometheusExporter._requestHandler (...)
```</alert_description>

<severity>high</severity>
<identifiers>GHSA-q7rr-3cgh-j5r3, CVE-2026-44902</identifiers>
<package>@opentelemetry/auto-instrumentations-node</package>
<ecosystem>npm</ecosystem>
<vulnerable_versions>^0.62.1</vulnerable_versions>
<patched_version>0.75.0</patched_version>
<manifest_path>package.json</manifest_path>

<references>
<url>https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-44902</url>
<url>https://github.com/advisories/GHSA-q7rr-3cgh-j5r3</url>
</references>

<agent_instructions>update the version</agent_instructions>

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected func...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Resolves e2b-dev/dashboard alert #14

[cla-bot]

We require contributors to sign our Contributor License Agreement, and we don't have @copilot on file. You can sign our CLA at https://e2b.dev/docs/cla . Once you've signed, post a comment here that says '@cla-bot check'

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview, Comment	Jun 9, 2026 5:55pm
web-juliett	Ready	Preview, Comment	Jun 9, 2026 5:55pm

[cla-bot]

We require contributors to sign our Contributor License Agreement, and we don't have @copilot on file. You can sign our CLA at https://e2b.dev/docs/cla . Once you've signed, post a comment here that says '@cla-bot check'

[ben-fornefeld]

@cla-bot check

[cla-bot]

The cla-bot has been summoned, and re-checked this pull request!

[Copilot]

Pull request overview

Updates the OpenTelemetry Node auto-instrumentation dependency to remediate CVE-2026-44902 (Prometheus exporter process crash on malformed HTTP requests) by ensuring patched OpenTelemetry Prometheus exporter versions are used in the resolved dependency graph.

Changes:

• Bump @opentelemetry/auto-instrumentations-node from ^0.62.1 to ^0.75.0.
• Regenerate bun.lock, removing the vulnerable @opentelemetry/[email protected] from the resolved tree and pulling in patched OpenTelemetry dependency versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps @opentelemetry/auto-instrumentations-node to the patched major/minor line (>= 0.75.0).
bun.lock	Updates the resolved dependency graph so @opentelemetry/[email protected] is no longer present and patched versions are used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ben-fornefeld]

closing this in favor of #371