{"id":"CVE-2026-44902","aliases":["EUVD-2026-32538","GHSA-q7rr-3cgh-j5r3","ROOT-APP-NPM-CVE-2026-44902"],"status":"published","title":"opentelemetry-js: Prometheus exporter process crash via malformed HTTP request","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00473,"percentile":0.41313,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2026-05-11T14:42:10Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"npm","package":"@opentelemetry/exporter-prometheus","fixed_in":["0.217.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@opentelemetry/sdk-node","fixed_in":["0.217.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@opentelemetry/auto-instrumentations-node","fixed_in":["0.75.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@opentelemetry/auto-instrumentations-node","fixed_in":["0.74.0-aikido.2","0.73.0-aikido.2","0.73.0-aikido.3","0.74.0-aikido.3","0.60.1-aikido.1","0.60.1-aikido.2","0.40.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@opentelemetry/exporter-prometheus","fixed_in":["0.202.0-aikido.2","0.216.0-aikido.2","0.207.0-aikido.2","0.215.0-aikido.2","0.213.0-aikido.2","0.204.0-aikido.2","0.207.0-aikido.3","0.204.0-aikido.3","0.202.0-aikido.3","0.215.0-aikido.3","0.213.0-aikido.3","0.216.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@opentelemetry/sdk-node","fixed_in":["0.202.0-aikido.2","0.213.0-aikido.2","0.216.0-aikido.2","0.204.0-aikido.2","0.207.0-aikido.2","0.215.0-aikido.2","0.202.0-aikido.3","0.216.0-aikido.3","0.213.0-aikido.3","0.207.0-aikido.3","0.215.0-aikido.3","0.204.0-aikido.3","0.46.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/opentelemetry__sdk-node","fixed_in":["0.204.0-root.io.1","0.202.0-root.io.1","0.207.0-root.io.1","0.213.0-root.io.1","0.215.0-root.io.1","0.216.0-root.io.1","0.202.0-root.io.2","0.213.0-root.io.2","0.216.0-root.io.2","0.204.0-root.io.2","0.207.0-root.io.2","0.215.0-root.io.2","0.202.0-root.io.3","0.216.0-root.io.3","0.213.0-root.io.3","0.207.0-root.io.3","0.215.0-root.io.3","0.204.0-root.io.3","0.46.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/opentelemetry__exporter-prometheus","fixed_in":["0.202.0-root.io.1","0.204.0-root.io.1","0.207.0-root.io.1","0.213.0-root.io.1","0.216.0-root.io.1","0.215.0-root.io.1","0.202.0-root.io.2","0.216.0-root.io.2","0.207.0-root.io.2","0.215.0-root.io.2","0.213.0-root.io.2","0.204.0-root.io.2","0.207.0-root.io.3","0.204.0-root.io.3","0.202.0-root.io.3","0.215.0-root.io.3","0.213.0-root.io.3","0.216.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/opentelemetry__auto-instrumentations-node","fixed_in":["0.74.0-root.io.1","0.73.0-root.io.1","0.74.0-root.io.2","0.73.0-root.io.2","0.73.0-root.io.3","0.74.0-root.io.3","0.60.1-root.io.1","0.60.1-root.io.2","0.40.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@opentelemetry/exporter-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.217.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@opentelemetry/sdk-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.57.0"},{"fixed":"0.217.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@opentelemetry/auto-instrumentations-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.55.0"},{"fixed":"0.75.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@opentelemetry/exporter-prometheus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.217.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@opentelemetry/sdk-node","ranges":[{"type":"SEMVER","events":[{"introduced":"0.57.0"},{"fixed":"0.217.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@opentelemetry/auto-instrumentations-node","ranges":[{"type":"SEMVER","events":[{"introduced":"0.55.0"},{"fixed":"0.75.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@opentelemetry/auto-instrumentations-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-aikido.2"},{"fixed":"0.73.0-aikido.2"},{"fixed":"0.73.0-aikido.3"},{"fixed":"0.74.0-aikido.3"},{"fixed":"0.60.1-aikido.1"},{"fixed":"0.60.1-aikido.2"},{"fixed":"0.40.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@opentelemetry/exporter-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.202.0-aikido.2"},{"fixed":"0.216.0-aikido.2"},{"fixed":"0.207.0-aikido.2"},{"fixed":"0.215.0-aikido.2"},{"fixed":"0.213.0-aikido.2"},{"fixed":"0.204.0-aikido.2"},{"fixed":"0.207.0-aikido.3"},{"fixed":"0.204.0-aikido.3"},{"fixed":"0.202.0-aikido.3"},{"fixed":"0.215.0-aikido.3"},{"fixed":"0.213.0-aikido.3"},{"fixed":"0.216.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@opentelemetry/sdk-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.202.0-aikido.2"},{"fixed":"0.213.0-aikido.2"},{"fixed":"0.216.0-aikido.2"},{"fixed":"0.204.0-aikido.2"},{"fixed":"0.207.0-aikido.2"},{"fixed":"0.215.0-aikido.2"},{"fixed":"0.202.0-aikido.3"},{"fixed":"0.216.0-aikido.3"},{"fixed":"0.213.0-aikido.3"},{"fixed":"0.207.0-aikido.3"},{"fixed":"0.215.0-aikido.3"},{"fixed":"0.204.0-aikido.3"},{"fixed":"0.46.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/opentelemetry__sdk-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.204.0-root.io.1"},{"fixed":"0.202.0-root.io.1"},{"fixed":"0.207.0-root.io.1"},{"fixed":"0.213.0-root.io.1"},{"fixed":"0.215.0-root.io.1"},{"fixed":"0.216.0-root.io.1"},{"fixed":"0.202.0-root.io.2"},{"fixed":"0.213.0-root.io.2"},{"fixed":"0.216.0-root.io.2"},{"fixed":"0.204.0-root.io.2"},{"fixed":"0.207.0-root.io.2"},{"fixed":"0.215.0-root.io.2"},{"fixed":"0.202.0-root.io.3"},{"fixed":"0.216.0-root.io.3"},{"fixed":"0.213.0-root.io.3"},{"fixed":"0.207.0-root.io.3"},{"fixed":"0.215.0-root.io.3"},{"fixed":"0.204.0-root.io.3"},{"fixed":"0.46.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/opentelemetry__exporter-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.202.0-root.io.1"},{"fixed":"0.204.0-root.io.1"},{"fixed":"0.207.0-root.io.1"},{"fixed":"0.213.0-root.io.1"},{"fixed":"0.216.0-root.io.1"},{"fixed":"0.215.0-root.io.1"},{"fixed":"0.202.0-root.io.2"},{"fixed":"0.216.0-root.io.2"},{"fixed":"0.207.0-root.io.2"},{"fixed":"0.215.0-root.io.2"},{"fixed":"0.213.0-root.io.2"},{"fixed":"0.204.0-root.io.2"},{"fixed":"0.207.0-root.io.3"},{"fixed":"0.204.0-root.io.3"},{"fixed":"0.202.0-root.io.3"},{"fixed":"0.215.0-root.io.3"},{"fixed":"0.213.0-root.io.3"},{"fixed":"0.216.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/opentelemetry__auto-instrumentations-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-root.io.1"},{"fixed":"0.73.0-root.io.1"},{"fixed":"0.74.0-root.io.2"},{"fixed":"0.73.0-root.io.2"},{"fixed":"0.73.0-root.io.3"},{"fixed":"0.74.0-root.io.3"},{"fixed":"0.60.1-root.io.1"},{"fixed":"0.60.1-root.io.2"},{"fixed":"0.40.3-root.io.1"}]}]}],"products":[{"vendor":"@opentelemetry","product":"auto-instrumentations-node"},{"vendor":"@opentelemetry","product":"exporter-prometheus"},{"vendor":"@opentelemetry","product":"sdk-node"},{"vendor":"open-telemetry","product":"opentelemetry-js"},{"vendor":"opentelemetry","product":"opentelemetry\\/auto-instrumentations-node"},{"vendor":"opentelemetry","product":"opentelemetry\\/exporter-prometheus"},{"vendor":"opentelemetry","product":"opentelemetry\\/sdk-node"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44902","tags":["advisory"]},{"url":"https://github.com/github/advisory-database/pull/10226","tags":["web"]},{"url":"https://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95","tags":["web"]},{"url":"https://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q7rr-3cgh-j5r3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44902.json","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44902","title":"opentelemetry-js: Prometheus exporter process crash via malformed HTTP request","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","status":"published","published":"2026-05-27T14:49:04.94Z","modified":"2026-05-28T15:26:13.701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-32538","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","status":"published","published":"2026-05-27T14:49:04Z","modified":"2026-05-28T15:26:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:21:02.581093Z"}],"ghsa":[{"id":"GHSA-q7rr-3cgh-j5r3","title":"Prometheus exporter process crash via malformed HTTP request","description":"## Summary\n\nA single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process.\n\n**You are affected by this vulnerability if either of the following apply to your application:**\n\n* you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server.\n* your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND**\n  * you use `@opentelemetry/sdk-node`\n  * you use  `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register`\n\n## Impact\n\n**Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.\n\n## Remediation\n\n### Update to the fixed version\n\nUpdate `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. \nUpdate `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later.\n\nThis release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process.\n\n```\nnpm install @opentelemetry/exporter-prometheus@latest\n```\n\n### Do Not Expose the Endpoint to Untrusted Users\n\n\u003e [!IMPORTANT] \n\u003e The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution.\n\nIf updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:\n\n* **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces\n\n* **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts\n\n* **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter\n\n## Details\n\nIn `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `\"http://\"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.\n\nThe Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port.\n\n## Proof of Concept\n\nStart any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet:\n\n```\necho -ne 'GET http:// HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' | nc localhost 9464\n```\n\nThe process crashes immediately with:\n\n```\nTypeError: Invalid URL\n    at new URL (...)\n    at PrometheusExporter._requestHandler (...)\n```","status":"published","published":"2026-05-11T14:42:10Z","modified":"2026-10-19T19:35:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-44902","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","status":"published","published":"2026-05-27T15:16:29.313Z","modified":"2026-08-27T16:16:49.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-44902","title":"opentelemetry-js: Prometheus exporter process crash via malformed HTTP request","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","status":"published","published":"2026-05-27T14:49:04.94Z","modified":"2026-10-28T02:30:42.627821982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-q7rr-3cgh-j5r3","title":"Prometheus exporter process crash via malformed HTTP request","description":"## Summary\n\nA single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default `0.0.0.0:9464`) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process.\n\n**You are affected by this vulnerability if either of the following apply to your application:**\n\n* you directly use `@opentelemetry/exporter-prometheus` in your code through its built-in server.\n* your `OTEL_METRICS_EXPORTER` environment variable includes `prometheus` **AND**\n  * you use `@opentelemetry/sdk-node`\n  * you use  `@opentelemetry/auto-instrumentations-node` via `--require @opentelemetry/auto-instrumentations-node/register`/`--import @opentelemetry/auto-instrumentations-node/register`\n\n## Impact\n\n**Denial of service.** Any application using the OpenTelemetry Prometheus exporter’s built-in server can be crashed by a single unauthenticated network packet sent to the metrics port. No authentication, special privileges, or prior access is required.\n\n## Remediation\n\n### Update to the fixed version\n\nUpdate `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later. \nUpdate `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later.\n\nThis release adds proper error handling around the URL constructor, returning an HTTP `400` response on parse failure rather than allowing the exception to propagate and crash the process.\n\n```\nnpm install @opentelemetry/exporter-prometheus@latest\n```\n\n### Do Not Expose the Endpoint to Untrusted Users\n\n\u003e [!IMPORTANT] \n\u003e The following mitigations reduce exposure but do not fully remediate the vulnerability. Any client that *can* reach the metrics endpoint - including your own Prometheus scraper host if compromised - could still trigger the crash. Updating to **0.217.0** is the recommended resolution.\n\nIf updating is not immediately feasible, restrict access to the metrics endpoint so that it is not reachable by untrusted or unauthenticated network clients. For example:\n\n* **Bind to localhost only** by setting the `host` option to `127.0.0.1` when configuring the `PrometheusExporter`, so the port is not exposed on public or shared network interfaces\n\n* **Use a firewall or network policy** to restrict access to port `9464` (or whichever port you have configured) to only trusted Prometheus scrape hosts\n\n* **Place the endpoint behind a reverse proxy** that filters or validates incoming requests before they reach the exporter\n\n## Details\n\nIn `PrometheusExporter.ts`, the `_requestHandler` calls `new URL(request.url, this._baseUrl)` without any error handling. Node's HTTP parser accepts absolute-form URIs (e.g. `http://`) for proxy compatibility, including malformed ones. When `request.url` is `\"http://\"`, the `URL` constructor throws `TypeError: Invalid URL`. Since there is no try-catch in the handler, the exception propagates as an uncaught exception and crashes the process.\n\nThe Prometheus metrics endpoint is unauthenticated by design (Prometheus scrapes it) and binds to `0.0.0.0` by default, meaning it is reachable by any network client that can connect to the metrics port.\n\n## Proof of Concept\n\nStart any Node.js application with the Prometheus exporter running on the default port `9464`, then send a single raw TCP packet:\n\n```\necho -ne 'GET http:// HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' | nc localhost 9464\n```\n\nThe process crashes immediately with:\n\n```\nTypeError: Invalid URL\n    at new URL (...)\n    at PrometheusExporter._requestHandler (...)\n```","status":"published","published":"2026-05-11T14:42:10Z","modified":"2026-10-19T19:45:04.420749729Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"ROOT-APP-NPM-CVE-2026-44902","title":"CVE-2026-44902 in @opentelemetry/auto-instrumentations-node - Patched by Root","description":"Root has patched CVE-2026-44902 in the @opentelemetry/auto-instrumentations-node package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T15:19:15Z","modified":"2026-10-08T16:15:03.162915546Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.649662Z"}]}}