129 matches found
CVE-2026-116693
A flaw was found in dd-trace. A remote attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with a malicious URL query string. The default regular expression used to obfuscate query string metadata performs excessive backtracking during evaluation, consuming high...
CLEANSTART-2026-BZ63180 dd-trace is the Datadog APM client for Node
CVE-2026-116693 affects multiple packages. dd-trace is the Datadog APM client for Node. See references for individual vulnerability details...
Regular Expression Denial Of Service (ReDoS)
dd-trace is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP pattern performing excessive backtracking on attacker‑controlled URL query strings, where the regex is applied synchronously while recording HTTP URL...
CVE-2026-116693
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...
@acala-network/bodhi (>=2.7.12, <=2.7.17), @acala-network/eth-providers (>=2.7.12, <=2.7.17) +74 more potentially affected by CVE-2026-116693 via dd-trace (>=2.6.0, <=5.121.0)
dd-trace NPM version =2.6.0, =2.7.12, =2.7.12, =2.4.8, =1.1.0, =1.0.0, =2.13.47, =2.0.0, =2.13.47, =0.0.0, =0.0.1, =3.38.1 - @bufferapp/bufflog 0.5.0 - @cchandragiri/runtime-handler 1.2.2 - @ciphercross-private/nestjs-datadog 1.0.0 and more Source cves: CVE-2026-116693 Source advisory:...
GHSA-X94G-W73Q-HPCW dd-trace: ReDOS in URL query string obfuscation
Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...
@acala-network/bodhi (>=2.7.12, <=2.7.17), @acala-network/eth-providers (>=2.7.12, <=2.7.17) +74 more potentially affected by CVE-2026-116693 via dd-trace (>=2.6.0, <=5.121.0)
dd-trace NPM version =2.6.0, =2.7.12, =2.7.12, =2.4.8, =1.1.0, =1.0.0, =2.13.47, =2.0.0, =2.13.47, =0.0.0, =0.0.1, =3.38.1 - @bufferapp/bufflog 0.5.0 - @cchandragiri/runtime-handler 1.2.2 - @ciphercross-private/nestjs-datadog 1.0.0 and more Source cves: CVE-2026-116693 Source advisory:...
dd-trace: ReDOS in URL query string obfuscation
Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...
npm: dd-trace: ReDOS in URL query string obfuscation
npm: dd-trace: ReDOS in URL query string obfuscation vulnerability discovered by ? in WordPress npm dd-trace versions = 2.0.0, 5.131.1...
@datadog/electron-sdk (>=0.8.1, <=1.0.0) potentially affected by CVE-2026-116693 via dd-trace (6.10.0)
dd-trace NPM version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dd-trace and may be impacted: - @datadog/electron-sdk =0.8.1, =1.0.0 Source cves: CVE-2026-116693 Source advisory: OSV:GHSA-X94G-W73Q-HPCW...
@datadog/electron-sdk (>=0.8.1, <=1.0.0) potentially affected by CVE-2026-116693 via dd-trace (6.10.0)
dd-trace NPM version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dd-trace and may be impacted: - @datadog/electron-sdk =0.8.1, =1.0.0 Source cves: CVE-2026-116693 Source advisory: GHSA-X94G-W73Q-HPCW...
CVE-2026-116693
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...
CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...
CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...
@datadog/electron-sdk (>=0.8.1, <=1.0.0) potentially affected by CVE-2026-116693 via dd-trace (6.10.0)
dd-trace NPM version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dd-trace and may be impacted: - @datadog/electron-sdk =0.8.1, =1.0.0 Source cves: CVE-2026-116693 Source advisory: MEND:CVE-2026-116693...
@acala-network/bodhi (>=2.7.12, <=2.7.17), @acala-network/eth-providers (>=2.7.12, <=2.7.17) +74 more potentially affected by CVE-2026-116693 via dd-trace (>=2.6.0, <=5.121.0)
dd-trace NPM version =2.6.0, =2.7.12, =2.7.12, =2.4.8, =1.1.0, =1.0.0, =2.13.47, =2.0.0, =2.13.47, =0.0.0, =0.0.1, =3.38.1 - @bufferapp/bufflog 0.5.0 - @cchandragiri/runtime-handler 1.2.2 - @ciphercross-private/nestjs-datadog 1.0.0 and more Source cves: CVE-2026-116693 Source advisory:...
CVE-2026-116693
The dd-trace Datadog APM client for Node.js is vulnerable to a Regular Expression Denial of Service (ReDoS) in the URL query string obfuscation logic. Specifically, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking when processing attacker-controlled URL quer...
EUVD-2026-111384
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a...
Datadog dd-trace-py: ReDoS in URL query string obfuscation
Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...
GHSA-3633-R77Q-H3V3 Datadog dd-trace-py: ReDoS in URL query string obfuscation
Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...