CVE-2026-116693 ยท GHSA-x94g-w73q-hpcw
dd-trace: ReDOS in URL query string obfuscation
- Risk score
- 67/100
- CVSS
- 8.7 v4.0
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The dd-trace library for Node.js has a regular expression denial of service (ReDOS) vulnerability in its URL query string obfuscation. An attacker could consume excessive CPU, stall request processing, and make the instrumented application unavailable.
- Affected
- {'products': ['dd-trace'], 'packages': [{'ecosystem': 'npm', 'name': 'dd-trace', 'vulnerable': '>= 2.0.0, < 5.131.1'}, {'ecosystem': 'npm', 'name': 'dd-trace', 'vulnerable': '>= 6.0.0, < 6.20.1'}]}
- Fix
- Upgrade to versions 5.131.1 or 6.20.1
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 8.7 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| dd-trace | npm | >= 2.0.0, < 5.131.1 | 5.131.1 |
| dd-trace | npm | >= 6.0.0, < 6.20.1 | 6.20.1 |
References
- https://github.com/advisories/GHSA-x94g-w73q-hpcw
- https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw
- https://github.com/DataDog/dd-trace-js/pull/10675
- https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b
- https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8
- https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1
- https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1
- https://github.com/advisories/GHSA-x94g-w73q-hpcw
Original description
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Last activity 27 Oct 2026. Patch Forecast updates every hour.