CVE-2026-116693 in dd-trace-js
Summary
by MITRE • 10/27/2026
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within Datadog's dd-trace library for Node.js represents a significant risk to application availability through resource exhaustion, specifically targeting the regular expression engine used for query string obfuscation. This flaw exists in versions ranging from 2.0.0 up to 5.131.1 and 6.20.1. The core issue stems from the default configuration of the DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP setting, which is designed to mask sensitive data within HTTP query parameters for security compliance purposes. However, the regular expression pattern employed in this default configuration contains structural characteristics that make it susceptible to catastrophic backtracking when processing maliciously crafted input. This type of vulnerability allows an attacker to craft URL queries with specific patterns that cause the regex engine to perform an exponential number of computational steps before determining a match or failure, effectively leading to a denial of service condition without requiring authentication or complex exploitation techniques beyond sending HTTP requests.
From a technical perspective, this flaw is classified under CWE-134: Use of Externally-Controlled Format String and more specifically relates to ReDoS (Regular Expression Denial of Service) vulnerabilities often categorized as CWE-185: Incorrect Regular Expression Complexity. The dd-trace agent processes incoming HTTP requests synchronously when recording metadata, including the URL query strings. Because the obfuscation regex is applied during this synchronous processing phase, any delay caused by excessive backtracking directly blocks the event loop in Node.js applications. This blocking behavior prevents the application from handling other concurrent requests, leading to a complete stall of service availability for all users interacting with the instrumented endpoint. The impact is severe because it allows remote attackers to trigger high CPU consumption and memory pressure simply by sending specific HTTP GET or POST requests containing crafted query parameters that exploit the regex engine's inefficiencies.
The operational impact of this vulnerability extends beyond simple performance degradation; it effectively renders the targeted Node.js application unavailable, constituting a classic Denial of Service attack vector. Since dd-trace is widely used for Application Performance Monitoring and distributed tracing in production environments, many organizations rely on these libraries to maintain visibility into their microservices architecture. An attacker exploiting this flaw can cause widespread outages across multiple services if the vulnerable library version is deployed broadly. The synchronous nature of the regex application means that even a single crafted request from one client can tie up server resources for an extended period, potentially cascading failures to dependent services or causing timeouts in upstream load balancers and API gateways. This highlights the critical importance of securing instrumentation libraries as part of the overall security posture, as they often run with elevated privileges and deep integration into the application lifecycle.
To mitigate this vulnerability, organizations must immediately upgrade their dd-trace dependencies to version 5.131.1 or later for Node.js versions compatible with that release line, or version 6.20.1 and above for newer environments where applicable. These patched versions address the regular expression complexity issues by optimizing the pattern matching logic to prevent catastrophic backtracking scenarios. In addition to upgrading, security teams should review their configuration files to ensure that custom obfuscation patterns do not introduce similar risks if they have overridden the default settings. It is also advisable to implement rate limiting and input validation at the network perimeter or API gateway level to restrict the volume of requests processed by vulnerable endpoints during the patching window. Furthermore, monitoring CPU usage metrics provided by the APM tool itself can help detect anomalous spikes that may indicate active exploitation attempts before they lead to complete service outages. This incident underscores the need for rigorous testing of third-party libraries and regular updates to maintain resilience against automated vulnerability scanning tools commonly used in reconnaissance phases mapped under MITRE ATT&CK technique T1496: Resource Hijacking, where attackers leverage system resources to disrupt availability rather than stealing data directly.