CVE-2026-116693
- Source
- https://cve.org/CVERecord?id=CVE-2026-116693
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116693.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-116693
- Aliases
- Downstream
CGA (19)
- CGA-2p2w-4vh9-fwmr
- CGA-3j46-cx74-cxq6
- CGA-489r-w6h8-5r8g
- CGA-5f75-q476-w7q4
- CGA-6386-7xjc-7jx6
- CGA-6v2g-mg3v-4rg5
- CGA-7jgm-h9fp-qx73
- CGA-8x3v-fhcg-65x4
- CGA-cg39-44mc-4qrm
- CGA-chvm-5rcj-v8fq
- CGA-cmhx-7jg8-wfxw
- CGA-cq7v-xqrv-22f8
- CGA-g8rp-vphm-m432
- CGA-hp45-7gmh-7qhm
- CGA-j72m-29gh-mq9q
- CGA-qv53-rmrx-4h2w
- CGA-vjj8-g7m5-6v95
- CGA-w5ww-5hvm-384m
- CGA-xjcf-c7rm-c288
- Published
- 2026-10-27T20:07:01Z
- Modified
- 2026-10-28T10:45:42Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- dd-trace: ReDOS in URL query string obfuscation
- Details
-
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1333" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116693.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116693.json
- https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b
- https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8
- https://github.com/DataDog/dd-trace-js/pull/10675
- https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1
- https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1
- https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw
- https://nvd.nist.gov/vuln/detail/CVE-2026-116693
Affected packages
Git / github.com/datadog/dd-trace-js
Affected ranges
- Type
- GIT
- Repo
- https://github.com/datadog/dd-trace-js
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.0.0" }, { "fixed": "5.131.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "6.0.0" }, { "fixed": "6.20.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "5eeee790c93036a50549056fc890028cb4c86b1b" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "cf4e68a45fa1442c9850f2086c81901258e821b8" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v5.131.1", "range": [ { "fixed": "2f04bd36d5bb876d8e7cf9c69ed4bd8f9e80b076" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v6.20.1", "range": [ { "fixed": "f3517f33400a7e5cce8f1c691fd54355ed63c206" } ], "source": "REFERENCES_TAG" } ] }