CVE-2026-116693

HighCVSS 8.7

Published: 27/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

In dd-trace, the Datadog APM client for Node.js, from 2.0.0 until 5.131.1 and 6.20.1 the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. This causes excessive CPU consumption and can stall request processing, making the application unavailable.

Risk Assessment

An attacker can remotely trigger a denial of service against the instrumented application via crafted HTTP requests. The result is service slowdown or unavailability.

Recommendation

Upgrade dd-trace to version 5.131.1 or 6.20.1 (or later). Consider adjusting or disabling the default obfuscation regex if not needed.

Other vulnerabilities in dd-trace

CVE-2026-50272High
The dd-trace (Node.js) client for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

Original NVD description (English source)

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS