CVE-2026-54285
Last modified
CVE-2026-54285 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-js | < 2.8.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-54285?
How severe is CVE-2026-54285?
How do I fix CVE-2026-54285?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-54279AIOHTTP is an asynchronous HTTP client/server framework for …7.5
- CVE-2026-5428The Royal Elementor Addons plugin for WordPress is vulnerabl…6.4
- CVE-2026-54280AIOHTTP is an asynchronous HTTP client/server framework for …7.5
- CVE-2026-54281Nest is a framework for building scalable Node.js server-sid…8.7
- CVE-2026-54282Starlette is a lightweight ASGI framework/toolkit. Prior to …5.3
- CVE-2026-54283Starlette is a lightweight ASGI framework/toolkit. From 0.4.…7.5
- CVE-2026-54286Hono is a Web application framework that provides support fo…5.9
- CVE-2026-54287Hono is a Web application framework that provides support fo…5.3
- CVE-2026-54288Hono is a Web application framework that provides support fo…6.5
- CVE-2026-54289Hono is a Web application framework that provides support fo…4.8
- CVE-2026-5429Unsanitized input during web page generation in the Kiro Age…7.8
- CVE-2026-54290Hono is a Web application framework that provides support fo…7.1
Are you affected by CVE-2026-54285?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST