CVE-2026-50272: Datadog dd-trace Node.js DoS Vulnerability

CVE-2026-50272 Overview

CVE-2026-50272 is a denial-of-service vulnerability in dd-trace, the Datadog Application Performance Monitoring (APM) client for Node.js. Versions prior to 5.100.0 parse incoming W3C baggage HTTP headers without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits during extraction. A remote, unauthenticated attacker can send a request containing an arbitrarily large baggage header, triggering unbounded CPU and memory consumption. The flaw affects any HTTP service that has baggage propagation enabled and is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. Datadog fixed the issue in dd-trace-js version 5.100.0.

Critical Impact
An unauthenticated remote attacker can exhaust CPU and memory on any Node.js HTTP service running a vulnerable dd-trace release, resulting in denial of service.

Affected Products

Datadog dd-trace-js (dd-trace) versions prior to 5.100.0
Node.js HTTP services instrumented with dd-trace and baggage propagation enabled
OpenTelemetry context propagation paths that route through dd-trace baggage extraction

Discovery Timeline

2026-07-17 - CVE-2026-50272 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-50272

Vulnerability Analysis

The vulnerability resides in the W3C baggage propagation logic within packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js. These modules parse the baggage HTTP header on every inbound request when propagation is enabled. Datadog exposes two configuration knobs, DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, that were enforced only when generating outbound baggage. On extraction, the parser iterated the entire header value regardless of size or item count. An attacker can therefore submit a baggage header containing millions of comma-separated key-value pairs, or a single oversized value, forcing the tracer to allocate memory and execute string operations proportional to attacker-controlled input.

Root Cause

The root cause is missing input validation on parsed baggage entries [CWE-770]. The extraction code split the incoming header on commas and processed every pair without checking the resulting count against DD_TRACE_BAGGAGE_MAX_ITEMS or the cumulative byte length against DD_TRACE_BAGGAGE_MAX_BYTES. Because parsing runs before any application logic, no upstream control can throttle the workload once the header reaches the tracer.

Attack Vector

Exploitation requires only the ability to send HTTP requests to a service running a vulnerable dd-trace version with baggage propagation active. No authentication, user interaction, or prior compromise is required. Repeated requests carrying oversized baggage headers drive event-loop stalls and heap growth, degrading or crashing the Node.js process.

javascript

// Security patch excerpt from packages/dd-trace/src/baggage.js
// Source: https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6
   return EMPTY_STORE
 }
 
+/**
+ * @param {BaggageStore} items Frozen in place; do not mutate after.
+ */
+function setAllBaggageItems (items) {
+  Object.freeze(items)
+  baggageStorage.enterWith(items)
+  return items
+}
+
 module.exports = {
   setBaggageItem,
+  setAllBaggageItems,
   getBaggageItem,
   getAllBaggageItems,
   removeBaggageItem,

The patch introduces setAllBaggageItems, which accepts a bounded, frozen baggage store produced by the extraction path after enforcing the configured caps. The companion change in packages/dd-trace/src/opentelemetry/context_manager.js switches the context manager from mutating individual items to installing the pre-validated store, ensuring inbound baggage cannot exceed limits. See the GitHub Security Advisory GHSA-wxqq-gcq8-c443 and Pull Request #8255 for full patch context.

Detection Methods for CVE-2026-50272

Indicators of Compromise

HTTP requests carrying baggage headers substantially larger than typical (kilobytes to megabytes) or containing thousands of comma-separated pairs.
Sudden Node.js event-loop lag, elevated heap usage, or process restarts on services running dd-trace versions earlier than 5.100.0.
Repeated 5xx responses or upstream timeouts correlated with anomalous baggage header traffic from a small set of source IPs.

Detection Strategies

Inspect access logs and reverse proxy telemetry for outsized baggage request headers and flag requests exceeding the operational baseline.
Correlate Node.js runtime metrics (heap, event-loop delay, RSS) with inbound HTTP header sizes to identify resource exhaustion patterns.
Inventory Node.js services using dd-trace and confirm installed versions with npm ls dd-trace to prioritize monitoring on unpatched hosts.

Monitoring Recommendations

Enable request header size logging at load balancers, API gateways, or ingress controllers fronting Node.js workloads.
Alert on process crashes, out-of-memory kills, and worker restarts of dd-trace-instrumented services.
Track dependency versions in Software Bill of Materials (SBOM) pipelines to detect regressions to pre-5.100.0 dd-trace releases.

How to Mitigate CVE-2026-50272

Immediate Actions Required

Upgrade dd-trace to version 5.100.0 or later across all Node.js services.
Audit deployed applications for direct and transitive dependencies on vulnerable dd-trace releases.
Restart affected services after upgrading to ensure the patched propagation logic is loaded.

Patch Information

The fix is available in dd-trace-js v5.100.0. The relevant change is delivered via commit a7d4c0d, which enforces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES during extraction and installs the resulting baggage store as an immutable object.

Workarounds

Strip or size-limit the inbound baggage header at a reverse proxy, WAF, or API gateway until upgrades are complete.
Disable baggage propagation on services that do not require it by unsetting the propagation style configuration.
Enforce a maximum request header size (for example, --max-http-header-size on Node.js) tuned to reject abusive payloads.

bash

# Upgrade dd-trace to the patched release
npm install dd-trace@^5.100.0

# Verify the installed version
npm ls dd-trace

# Example NGINX safeguard: cap total request header size
# large_client_header_buffers 4 8k;

# Example Node.js runtime cap on inbound header bytes
node --max-http-header-size=16384 app.js