CVE-2026-116693

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116693", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T20:00:59.830Z", "datePublished": "2026-10-27T20:07:01.195Z", "dateUpdated": "2026-10-30T19:25:57.583Z"}, "containers": {"cna": {"title": "dd-trace: ReDOS in URL query string obfuscation", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"}, {"name": "https://github.com/DataDog/dd-trace-js/pull/10675", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-js/pull/10675"}, {"name": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b"}, {"name": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8"}, {"name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1"}, {"name": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"}], "affected": [{"vendor": "DataDog", "product": "dd-trace-js", "versions": [{"version": ">= 2.0.0, < 5.131.1", "status": "affected"}, {"version": ">= 6.0.0, < 6.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T20:07:01.195Z"}, "descriptions": [{"lang": "en", "value": "dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."}], "source": {"advisory": "GHSA-x94g-w73q-hpcw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T19:25:49.800441Z", "id": "CVE-2026-116693", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:25:57.583Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116693", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T19:25:49.800441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:25:54.130Z"}}], "cna": {"title": "dd-trace: ReDOS in URL query string obfuscation", "source": {"advisory": "GHSA-x94g-w73q-hpcw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "DataDog", "product": "dd-trace-js", "versions": [{"status": "affected", "version": ">= 2.0.0, < 5.131.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.1"}]}], "references": [{"url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw", "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DataDog/dd-trace-js/pull/10675", "name": "https://github.com/DataDog/dd-trace-js/pull/10675", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b", "name": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8", "name": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1", "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1", "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T20:07:01.195Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116693", "state": "PUBLISHED", "dateUpdated": "2026-10-30T19:25:57.583Z", "dateReserved": "2026-10-26T20:00:59.830Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T20:07:01.195Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dd-trace-js", "vendor": "DataDog", "versions": [{"status": "affected", "version": ">= 2.0.0, < 5.131.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."}], "id": "CVE-2026-116693", "lastModified": "2026-10-30T20:17:05.607", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116693", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T19:25:49.800441Z", "version": "2.0.3"}}]}, "published": "2026-10-27T21:18:05.167", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/pull/10675"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "dd-trace: dd-trace: Denial of Service via regular expression backtracking on query strings", "id": "2562395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562395"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.", "A flaw was found in dd-trace. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request with a malicious URL query string. The default regular expression used to obfuscate query string metadata performs excessive backtracking during evaluation, consuming high CPU resources and rendering the instrumented application unavailable."], "name": "CVE-2026-116693", "public_date": "2026-10-27T20:07:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116693\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116693\nhttps://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b\nhttps://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8\nhttps://github.com/DataDog/dd-trace-js/pull/10675\nhttps://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1\nhttps://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1\nhttps://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"], "statement": "This vulnerability is rated as Important because a remote, unauthenticated attacker can exploit catastrophic regular expression backtracking to exhaust CPU resources, blocking the single-threaded Node.js event loop and causing a complete denial of service for the target service. The issue stems from synchronous evaluation of query string obfuscation rules triggered automatically on incoming HTTP requests when tracing is enabled. Red Hat Enterprise Linux and OpenShift do not ship dd-trace by default, but customer applications built on Red Hat runtimes and instrumented with this client library are susceptible without explicit configuration changes.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,5.131.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.20.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dd-trace-js", "source": "cna", "vendor": "DataDog"}, "product": "dd-trace-js", "vendor": "datadog"}], "created": "2026-10-27T21:45:08.302419+00:00", "updated": "2026-10-27T22:30:10.505830+00:00", "vendors": ["datadog", "datadog$PRODUCT$dd-trace-js"]}