Excessive Backtracking Vulnerability in Datadog APM Client for Node.js
CVE-2026-116693
8.7HIGH
What is CVE-2026-116693?
The dd-trace, an APM client for Node.js developed by Datadog, contains a vulnerability that stems from the default regex configuration for query string obfuscation. Found in versions 2.0.0 up to 5.131.1 and 6.20.1, this vulnerability can lead to excessive CPU consumption. Attackers can exploit this by crafting specific URL query strings that cause the regular expression to perform excessive backtracking, thereby stalling request processing and potentially overwhelming the application. This issue has been resolved in later versions 5.131.1 and 6.20.1.
Affected Version(s)
dd-trace-js >= 2.0.0, < 5.131.1 < 2.0.0, 5.131.1
dd-trace-js >= 6.0.0, < 6.20.1 < 6.0.0, 6.20.1