{"id":"CVE-2026-116693","state":"PUBLISHED","title":"dd-trace: ReDOS in URL query string obfuscation","description":"dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.","publishedAt":"2026-10-27T20:07:01.195Z","updatedAt":"2026-10-30T19:25:57.583Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["DataDog dd-trace-js"],"affected":[{"vendor":"DataDog","product":"dd-trace-js","versions":[{"version":">= 2.0.0, < 5.131.1","status":"affected"},{"version":">= 6.0.0, < 6.20.1","status":"affected"}]}],"references":["https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw","https://github.com/DataDog/dd-trace-js/pull/10675","https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"],"weaknesses":["CWE-1333"],"ingestedAt":"2026-10-30T19:48:04.455Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/116xxx/CVE-2026-116693.json","commit":"91beacf46587178cb335e3399e6db92524d41de0","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116693","state":"PUBLISHED","datePublished":"2026-10-27T20:07:01.195Z","dateUpdated":"2026-10-30T19:25:57.583Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-10-26T20:00:59.830Z"},"containers":{"cna":{"title":"dd-trace: ReDOS in URL query string obfuscation","descriptions":[{"lang":"en","value":"dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."}],"affected":[{"vendor":"DataDog","product":"dd-trace-js","versions":[{"version":">= 2.0.0, < 5.131.1","status":"affected"},{"version":">= 6.0.0, < 6.20.1","status":"affected"}]}],"references":[{"url":"https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw","name":"https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/DataDog/dd-trace-js/pull/10675","name":"https://github.com/DataDog/dd-trace-js/pull/10675","tags":["x_refsource_MISC"]},{"url":"https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","name":"https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","tags":["x_refsource_MISC"]},{"url":"https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","name":"https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","tags":["x_refsource_MISC"]},{"url":"https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","name":"https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1","name":"https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1333","lang":"en","description":"CWE-1333: Inefficient Regular Expression Complexity","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-27T20:07:01.195Z"},"source":{"advisory":"GHSA-x94g-w73q-hpcw","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T19:25:49.800441Z","id":"CVE-2026-116693","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T19:25:57.583Z"}}]}}}