Cloudanix VulnDB

CVE-2026-116693

None

CVSS

—

EPSS

0.4%

Published

Oct 27, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A monitoring library used in some web applications can be tricked by specially crafted web addresses into using so much processing power that the application becomes slow or stops responding.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

ReDoS vulnerability where the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP performs catastrophic backtracking on attacker-supplied query strings; the regex executes synchronously during HTTP metadata recording in the APM client, exhausting CPU and stalling request handling.

Why it matters to the business

Crafted requests can render instrumented Node.js applications unresponsive or unavailable, leading to service disruption and potential downtime for any application using the affected Datadog APM client.

How an attack unfolds

An attacker crafts a URL query string engineered to trigger excessive backtracking in the default obfuscation regex, sends it via a normal HTTP request to the instrumented application, and the synchronous regex evaluation consumes CPU until the request stalls or times out.

How to fix it

Upgrade dd-trace to version 5.131.1, 6.20.1, or later; alternatively, override DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP with a safer pattern or disable query-string obfuscation if feasible.

How to confirm the fix worked

Confirm the installed dd-trace version is at least 5.131.1 or 6.20.1; test by sending known ReDoS query strings and verifying that request latency and CPU usage remain bounded.

Typical attack path

  1. Identify an endpoint instrumented by vulnerable dd-trace
  2. Craft a query string that induces catastrophic backtracking
  3. Transmit the request to the target application
  4. Observe CPU exhaustion and request processing stall

How to detect it

Correlate high-CPU request handling with unusually long or complex query strings in HTTP access logs; inspect APM traces for extended spans during URL metadata recording.

What your security team should do

  • Prioritize upgrade of dd-trace to 5.131.1 or 6.20.1 across all Node.js services
  • Temporarily disable or replace the default query-string regex until patches are applied
  • Monitor CPU and request latency for anomalies on instrumented endpoints
  • Review dependency manifests to locate all instances of the vulnerable library

The record

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities