What is the CVSS score of CVE-2026-50272?

CVE-2026-50272 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of dd-trace-js are affected by CVE-2026-50272?

The Datadog dd-trace-js Node.js tracing library in versions before 5.100.0 contains a remote denial-of-service vulnerability that allows attackers to exhaust CPU and memory on internet-facing…. A patch is available.

How to fix or mitigate CVE-2026-50272?

Within 24 hours, identify and inventory all Node.js applications using dd-trace-js versions below 5.100.0, prioritize internet-facing services, and implement emergency controls: deploy WAF rules to reject baggage headers exceeding 8,192 bytes, enable strict rate limiting per source IP, and configure monitoring for memory/CPU spikes. Within 7 days, contact Datadog support for patch status and timeline, validate compensating controls are effective in staging environments, and establish communication plans for affected teams. Within 30 days, deploy remediation as guidance becomes available from Datadog, prioritizing internet-facing and business-critical services, and confirm through testing that DoS vectors are fully mitigated.

dd-trace-js CVE-2026-50272

EUVD-2026-45323 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-15 https://github.com/DataDog/dd-trace-js

GHSA-wxqq-gcq8-c443

Nginx Apache Denial Of Service

7.5

CVSS 3.1 · Vendor: https://github.com/DataDog/dd-trace-js

Severity by source

Vendor (https://github.com/DataDog/dd-trace-js) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity header parsing against default-enabled baggage yields PR:N/AC:L/AV:N; impact is availability-only resource exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/DataDog/dd-trace-js).

CVSS VectorVendor: https://github.com/DataDog/dd-trace-js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 23:17 vuln.today

Analysis Generated

Jul 15, 2026 - 23:17 vuln.today

CVE Published

Jul 15, 2026 - 22:58 github-advisory

HIGH 7.5

DescriptionCVE.org

Impact

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled. The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.

Patches

This is resolved in version 5.100.0 and later of the dd-trace-js library.

Workarounds

If users cannot upgrade immediately:

Disable baggage extraction by removing baggage from DD_TRACE_PROPAGATION_STYLE (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently).
Cap the maximum HTTP request header size at an upstream proxy or web server (for example, Apache LimitRequestFieldSize, Nginx large_client_header_buffers, Envoy max_request_headers_kb).

Resources

Articles & Coverage 2

News 11 New Nginx Vulnerabilities - 1 Critical, 10 High Severity Jul 16, 2026 News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100.0) allows attackers to exhaust CPU and memory by sending an HTTP request with an oversized W3C 'baggage' header. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on injection and not on the extraction path, the tracer allocates a hash-map entry per comma-separated pair on every request. With baggage propagation enabled by default, any internet-facing instrumented service is exposed. CVSS 3.1 base score is 7.5 (A:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw sits in dd-trace-js's implementation of W3C Trace Context 'baggage' propagation, a standard mechanism for carrying user-defined key-value context across distributed services via the 'baggage' HTTP header (comma-separated key=value pairs). On the extract/parse path the library iterates the incoming header and allocates a hash-map entry for each pair without bounding the number of items or total byte size, so attacker-controlled input directly drives unbounded allocation and parsing work. This is a classic CWE-400 (Uncontrolled Resource Consumption) issue: the same DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits that protect the inject path were never wired into extraction. The affected package is the npm distribution pkg:npm/dd-trace. The advisory notes the same design defect affected sibling OpenTelemetry tracers (opentelemetry-go GHSA-mh2q-q3fh-2475, opentelemetry-dotnet GHSA-g94r-2vxg-569j), indicating a cross-ecosystem parsing pattern rather than a single-library mistake.

RemediationAI

Vendor-released patch: upgrade dd-trace to 5.100.0 or later, which enforces the item-count and byte-size caps on the extraction path per GHSA-wxqq-gcq8-c443. If immediate upgrade is not possible, disable baggage extraction by removing 'baggage' from DD_TRACE_PROPAGATION_STYLE (or from DD_TRACE_PROPAGATION_STYLE_EXTRACT if configured independently); the trade-off is loss of baggage-based context propagation in distributed traces while other propagation styles continue to function. As a defense-in-depth control, cap the maximum HTTP request header size at an upstream proxy or web server - for example Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb - noting that an overly aggressive limit can reject legitimate large-header requests, so tune it above normal traffic. Consult the advisory at https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443 for details.