Skip to content
OpenAdvisories

Package · npm

@opentelemetry/core

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 5.3
    CVE-2026-54285

    opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation

    opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 …

    open-telemetry opentelemetry-js langfuse-3-worker renovate Wolfi npm