dd-trace-js EUVD-2026-45323

Exploitation requires that the target HTTP service is instrumented with a vulnerable dd-trace-js version (< 5.100.0) and has the 'baggage' propagation style enabled on the extract path - which is the default in most affected tracers, so no non-default tuning is needed unless an operator has explicitly narrowed DD_TRACE_PROPAGATION_STYLE / DD_TRACE_PROPAGATION_STYLE_EXTRACT to exclude baggage. The service must also be reachable by the attacker over HTTP. No authentication, credentials, or user interaction are required (PR:N/UI:N). The main limiting factors are: the tracer must actually process the inbound baggage header (baggage not removed from the extract propagation styles), and an upstream proxy/web server enforcing a small max-header-size will blunt or block the oversized header before it reaches the tracer.

The signals are internally consistent and point to a genuine, easily reachable availability risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes network reach, low complexity, no privileges and no user interaction, with impact isolated to availability (C:N/I:N) - accurate for a DoS. The key amplifier beyond raw CVSS is deployment posture: baggage propagation is enabled by default, so exploitation needs no special target configuration, only that an affected tracer version instruments an internet-facing HTTP service. Tempering factors: this is availability-only (no data disclosure or code execution), and the impact is a resource-exhaustion DoS rather than compromise, so it is a priority for exposed high-availability services but not a confidentiality/integrity emergency. No EPSS score was provided in the input, so exploitation-probability cannot be quantified; it is not in CISA KEV and no POC is referenced, so there is currently no evidence of active exploitation despite the low attack complexity.

An attacker identifies an internet-facing Node.js service instrumented with a vulnerable dd-trace version and sends a single crafted HTTP request whose 'baggage' header contains hundreds of thousands of comma-separated key=value pairs (or one enormous value). The tracer parses and allocates a hash-map entry for every pair on each request, spiking CPU and memory; repeating the request rapidly drives the service to exhaustion and unavailability. Exploitation needs no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), though no public POC is referenced at time of analysis.