Live › vulnerability › CVE-2026-116693
Go to dashboarddd-trace is Datadog's Node.js tracing library, and its default regex that obfuscates URL query strings can backtrack excessively on crafted input. An attacker who sends such requests can drive CPU use up and make the application slow or unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:09 UTC, 0h before NVD. All times on this page are UTC.
Applications that run dd-trace 2.0.0 up to 5.131.1, or 6.0.0 up to 6.20.1, with the HTTP tracing integration enabled. The vulnerable pattern runs by default on query strings in URL span tags, so default configurations are exposed. Teams that do not use dd-trace, or run a patched version, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| dd-trace | npm | >= 2.0.0, < 5.131.1 | 5.131.1 |
| dd-trace | npm | >= 6.0.0, < 6.20.1 | 6.20.1 |
npm ls dd-trace in each Node.js project to find the installed version.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP is set in the environment or deployment config.5.131.1 on the 5.x line, or to 6.20.1 on the 6.x line.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed regex from the advisory and restart the application.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations.
The default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period.
As a workaround, set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed regex below, then restart the application.
DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP='(?:(?:"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\s|%20)*(?::|%3A)(?:\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|(?:bearer(?:\s|%20)+[a-z0-9._\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|(?:(?<![\w-])|(?<=%[0-9a-f]{2}))ey[I-L][\w-]+(?:=|%3D)*\.ey[I-L][\w-]+(?:=|%3D)*(?:\.(?:[\w.+/=-]|%3D|%2F|%2B)+)?|-{5}BEGIN(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY-{5}[^\-]+-{5}END(?:[a-z\s]|%20)+PRIVATE(?:\s|%20)KEY(?:-{5})?(?:\n|%0A)?|(?:ssh-(?:rsa|dss)|ecdsa-[a-z0-9]+-[a-z0-9]+)(?:\s|%20|%09)+(?:[a-z0-9/.+]|%2F|%5C|%2B){100,}(?:=|%3D)*(?:(?:\s|%20|%09)+[a-z0-9._-]+)?)'
Detailed triggering inputs and reproduction steps are omitted from this advisory. The patched version includes regression coverage for the affected behavior.
Regular expression denial of service (ReDoS) affecting applications that process attacker-controlled URL query strings through the vulnerable obfuscation pattern. Successful exploitation can cause excessive CPU consumption, prolonged request latency, and service unavailability.
The vulnerable processing is enabled by default for affected HTTP integrations that include query strings in URL span tags.
This page as .md · .json · in your agent: get_signal("CVE-2026-116693")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.