CVE-2026-50272 dd-trace: Improper parsing of W3C baggage headers may lead to DoS
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-50272?
CVE-2026-50272 is a high-severity vulnerability in DataDog dd-trace-js, published on 17 Jul 2026.
Official description
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-50272?
2 open source packages ship an affected version, including dd-trace.
| Package | Affected | Fixed in |
|---|---|---|
dd-trace npm | All versions | 5.100.0 |
dd-trace npm | All versions | 5.100.0 |
How do I fix CVE-2026-50272?
Upgrade dd-trace to 5.100.0 or later.
Is CVE-2026-50272 being exploited?
There is no known exploitation of CVE-2026-50272 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GR75196, GHSA-wxqq-gcq8-c443, MINI-wq4h-c6wq-jjv9, ROOT-APP-NPM-CVE-2026-50272.