CVE-2026-50272 Details
Description
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.
A denial-of-service vulnerability has been identified in the Datadog APM client for Node.js, specifically in versions prior to 5.100.0. The issue arises from improper handling of W3C baggage headers. The extraction process for incoming baggage HTTP headers did not apply the necessary limits on the number of items or the total byte size, allowing remote, unauthenticated attackers to send requests with excessive or oversized baggage data. This oversight led to unbounded consumption of CPU and memory resources, causing a remote denial-of-service condition on any HTTP service with baggage propagation enabled.
Users can upgrade to dd-trace version 5.100.0 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, W3C baggage extraction can be disabled by removing 'baggage' from the 'DD_TRACE_PROPAGATION_STYLE' environment variable. Alternatively, the maximum HTTP request header size can be capped at an upstream proxy or web server.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |