CVE-2026-116693
Received Received - Intake

ReDoS in dd-trace Node.js APM Client

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116693
EUVD
EUVD-2026-111384

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
DataDog dd-trace-js >= 2.0.0, < 5.131.1
DataDog dd-trace-js >= 6.0.0, < 6.20.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Datadog APM client for Node.js (dd-trace). It involves a default regular expression used for obfuscating query strings in URLs. The regex can cause excessive backtracking when processing attacker-controlled query strings, leading to high CPU usage, stalled request processing, and potential unavailability of the application.

Impact Analysis

An attacker could exploit this by sending crafted requests with malicious query strings. This may result in denial of service due to high CPU consumption, slow response times, or complete application unavailability. Systems using affected versions of dd-trace are vulnerable.

Mitigation Strategies

Upgrade dd-trace to version 5.131.1 or later for Node.js applications using affected versions. If using version 6.x, upgrade to 6.20.1 or later. This addresses the excessive backtracking issue in DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart