CVE-2026-116693

🗓️ 27 Oct 2026 20:07:01Reported by GitHub_MType

ReDOS in dd-trace URL query string obfuscation allows DoS of the instrumented application.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-116693	27 Oct 202620:20	–	circl
Cvelist	CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation	27 Oct 202620:07	–	cvelist
EUVD	EUVD-2026-111384	27 Oct 202620:07	–	euvd
Github Security Blog	dd-trace: ReDOS in URL query string obfuscation	27 Oct 202621:07	–	github
NVD	CVE-2026-116693	27 Oct 202621:18	–	nvd
osv_cga	CGA-3J46-CX74-CXQ6	28 Oct 202603:45	–	osv_cga
osv_cga	CGA-5F75-Q476-W7Q4	28 Oct 202603:08	–	osv_cga
osv_cga	CGA-6V2G-MG3V-4RG5	28 Oct 202602:40	–	osv_cga
osv_cga	CGA-8X3V-FHCG-65X4	28 Oct 202602:40	–	osv_cga
osv_cga	CGA-CHVM-5RCJ-V8FQ	28 Oct 202603:07	–	osv_cga

Vulners

Node

datadog dd-trace-jsRange2.0.0–5.131.1

datadog dd-trace-jsRange6.0.0–6.20.1

[
  {
    "vendor": "DataDog",
    "product": "dd-trace-js",
    "versions": [
      {
        "version": ">= 2.0.0, < 5.131.1",
        "status": "affected"
      },
      {
        "version": ">= 6.0.0, < 6.20.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b
github	www.github.com/DataDog/dd-trace-js/releases/tag/v6.20.1
github	www.github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw
github	www.github.com/DataDog/dd-trace-js/pull/10675
github	www.github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8
github	www.github.com/DataDog/dd-trace-js/releases/tag/v5.131.1

27 Oct 2026 21:18Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

CWE-1333