@opentelemetry/instrumentation-mongoose vulnerabilities (npm)

1 vulnerability.

• @opentelemetry/instrumentation-mongoose npm Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872 Fix available 5.8 MediumOctober 2, 2026