CVE-2026-116693

EUVD-2026-111384

27.10.2026, 21:18

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.7 HIGH	NETWORK	LOW	NONE	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-1333 - Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b

https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8

https://github.com/DataDog/dd-trace-js/pull/10675

https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1

https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1

https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw