CVE-2026-50272: 
JavaScript 취약성 분석 및 완화

CVE-2026-50272 is a remote Denial of Service vulnerability in dd-trace, the Datadog APM client for Node.js, caused by improper parsing of W3C baggage HTTP headers. The vulnerability affects all versions of the dd-trace npm package prior to 5.100.0. It was first published to the GitHub Advisory Database on July 15, 2026, with the underlying fix merged on May 4, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Datadog Advisory).

The root cause is an asymmetric enforcement of resource limits (CWE-400, CWE-770): the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) configuration limits were applied only during baggage injection (outbound), but not during baggage extraction (inbound) in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js. On each inbound HTTP request, the tracer's _extractBaggageItems method split the raw baggage header on commas and allocated a hash-map entry plus an AsyncLocalStorage.enterWith call for every key-value pair, with no upper bound on count or total byte size. An attacker can exploit this by sending HTTP requests with a baggage header containing an arbitrarily large number of comma-separated key-value pairs or a single extremely large value, causing unbounded CPU and memory consumption (Datadog Advisory, Fix PR, Fix Commit).

Successful exploitation causes unbounded CPU and memory consumption on the targeted Node.js service, leading to a complete availability failure (remote Denial of Service). Because baggage propagation is enabled by default in dd-trace, any internet-facing HTTP service instrumented with an affected version is exposed without requiring authentication or user interaction. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Github Advisory, Datadog Advisory).

1. Reconnaissance: Identify internet-facing HTTP services instrumented with dd-trace versions prior to 5.100.0 (e.g., by inspecting response headers, error messages, or npm package manifests if accessible).
2. Confirm baggage propagation is active: By default, DD_TRACE_PROPAGATION_STYLE includes baggage, so no special configuration is needed on the target. Confirm by sending a normal request and observing whether baggage headers are echoed or propagated.
3. Craft malicious baggage header: Construct an HTTP request with a baggage header containing either (a) a very large number of comma-separated key-value pairs (e.g., key1=val1,key2=val2,...,keyN=valN with N >> 64) or (b) a single key with an extremely large value (e.g., foo= followed by megabytes of data).
4. Send the request: Transmit the crafted request to any HTTP endpoint of the target service. No authentication is required.
5. Trigger resource exhaustion: The tracer's extraction path allocates a hash-map entry for each pair without limit, consuming CPU and memory on every such request. Sending requests in rapid succession amplifies the effect, potentially crashing or hanging the service (Datadog Advisory, Fix Commit).

• Network: Inbound HTTP requests containing abnormally large baggage headers (e.g., headers exceeding 8 KB or containing more than 64 comma-separated key-value pairs); high-frequency requests to any endpoint from a single source IP with oversized baggage values.
• Logs: Node.js process logs or APM tracer logs showing repeated baggage extraction activity; application logs indicating out-of-memory errors or process crashes correlated with spikes in inbound traffic.
• Process: Sudden, sustained spikes in CPU and/or memory usage by the Node.js process without a corresponding increase in legitimate application load; process restarts or OOM-killer events in system logs (dmesg, /var/log/syslog) targeting the Node.js service PID.
• Metrics: Datadog APM metrics showing elevated context_header.truncated counts (tag truncation_reason:baggage_item_count_exceeded or truncation_reason:baggage_byte_count_exceeded) if running a patched version that has been upgraded, or anomalous context_header_style.extracted rates on unpatched versions.

Upgrade dd-trace to version 5.100.0 or later, which enforces DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES limits on the extraction path (Release Notes). If an immediate upgrade is not possible, apply one or both of the following workarounds: (1) Disable baggage extraction by removing baggage from the DD_TRACE_PROPAGATION_STYLE environment variable (or DD_TRACE_PROPAGATION_STYLE_EXTRACT if set independently); (2) Cap the maximum HTTP request header size at an upstream proxy or web server — for example, using Apache LimitRequestFieldSize, Nginx large_client_header_buffers, or Envoy max_request_headers_kb (Datadog Advisory).

The vulnerability was noted in the CISA vulnerability bulletin SB26-201, indicating it was included in a weekly summary of high-priority vulnerabilities. A Mastodon post from @thehackerwire referenced the advisory shortly after publication. The issue is analogous to similar baggage-parsing DoS vulnerabilities disclosed in other OpenTelemetry ecosystem libraries, specifically opentelemetry-go (GHSA-mh2q-q3fh-2475) and opentelemetry-dotnet (GHSA-g94r-2vxg-569j), suggesting a broader pattern of missing extraction-side limits in distributed tracing libraries (Datadog Advisory).