@opentelemetry/core vulnerabilities

Latest @opentelemetry/core CVEs

Newest publication first

1. CVE-2026-54285 opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation

   Published 2026-06-22

   Medium·CVSS 5.3 EPSS 0.40%

   opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.