OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Description

W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path.

Recommendation

Update the @opentelemetry/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.8.0
• Patched version(s): 2.8.0

References

• GHSA-8988-4f7v-96qf
• CVE-2026-54285
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
• Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter - CVE-2026-29112
• Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@opentelemetry/core