opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54285 · Microsoft / collected KEV context

EUVD-2026-38321

GHSA-8988-4f7v-96qf

cve-program · CVE-2026-54285

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf

euvd · EUVD-2026-38321

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf

nvd · CVE-2026-54285

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf

osv · GHSA-8988-4f7v-96qf

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf
• https://nvd.nist.gov/vuln/detail/CVE-2026-54285
• https://github.com/open-telemetry/opentelemetry-js

No related operational record is retained in the current change model.