Datadog dd-trace-js: Regular expression denial of service in query string obfuscation
Summary
The Datadog APM tracer for Node.js (dd-trace) uses a default regular expression to obfuscate URL query strings. The expression can backtrack excessively on crafted query strings, and it is applied synchronously while the tracer records HTTP URL metadata. An unauthenticated remote attacker can send a crafted request to consume CPU and stall request processing, making the instrumented application unavailable. The impact is limited to availability.
Affected
- dd-trace-js 2.0.0 up to but not including 5.131.1
- dd-trace-js 6.0.0 up to but not including 6.20.1
Fixed in
- 5.131.1
- 6.20.1
- Later releases also include the fix. Check the current npm version before deploying.
Workaround
- Upgrading is the fix. Unknown: no vendor-verified workaround is available.
Exploitation
- No confirmed in-the-wild exploitation known.
- No public proof-of-concept exploit known according to VulDB.
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory Node.js projects and container images for dd-trace (package.json, lockfiles, image SBOMs).
- Upgrade to dd-trace 5.131.1 or 6.20.1 or later and rebuild container images.
- Prioritise internet-facing services.
- Monitor CPU usage and latency on affected services after patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 5eeee79 github.com
- Fix commit cf4e68a github.com
- Pull request #10675 github.com
- Release v5.131.1 github.com
- Release v6.20.1 github.com
- GitHub Security Advisory GHSA-x94g-w73q-hpcw github.com
- GitLab Advisory Database entry advisories.gitlab.com
- VulDB entry 427565 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:51.
Original description (NVD)
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
NVD references (6)
- https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b
- https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8
- https://github.com/DataDog/dd-trace-js/pull/10675
- https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1
- https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1
- https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.