CVE-2026-44902 affects OpenTelemetry JavaScript Client prior to version 0.217.0. A single malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The vulnerability exists in the metrics endpoint (default 0.0.0.0:9464) which lacks error handling around URL parsing. When an invalid URI is sent in a request, it causes an uncaught TypeError that terminates the entire process. This represents a denial of service vulnerability that can be triggered by a single malicious request. The issue has been patched in version 0.217.0.