High severity · published Oct 27, 2026
CVE-2026-116693
dd-trace: ReDOS in URL query string obfuscation
New
8.7
CVSS
–
EPSS
No
On KEV
Description
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
dd-trace-js · DataDog
>= 2.0.0, < 5.131.1; >= 6.0.0, < 6.20.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116693
github.com
https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b
github.com
https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8
github.com
https://github.com/DataDog/dd-trace-js/pull/10675
github.com
https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1
github.com
https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1
github.com
https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw
More from dd-trace-js
7.5
CVE-2026-50272
dd-trace: Improper parsing of W3C baggage headers may lead to DoS