dd-trace‑js, the Datadog APM client for Node.js, processes incoming W3C baggage headers without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits. A remote, unauthenticated attacker can craft a request whose baggage header contains an arbitrarily large number of comma‑separated key‑value pairs or a single extremely large value, forcing the library to use unbounded CPU and memory and creating a denial‑of‑service for any HTTP service with baggage propagation enabled. The bug is a resource‑exhaustion flaw (CWE‑770). It is addressed in version 5.100.0.

The vulnerability affects the DataDog dd‑trace‑js library in all releases prior to version 5.100.0. Any Node.js HTTP service that enables baggage propagation and uses this library is exposed.

The CVSS score of 7.5 indicates a high impact if exploited, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of active exploitation. It is not listed in the CISA KEV catalog, meaning it has not yet been confirmed as a widely exploited vulnerability. An attacker can trigger the DoS by crafting a request bearing a malicious baggage header, with no authentication or special privileges required. The problem is resolved in version 5.100.0, but services not yet patched remain at risk.