CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116693?
CVE-2026-116693 is a high-severity vulnerability in DataDog dd-trace-js, published on 27 Oct 2026.
Official description
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-116693?
4 open source packages ship an affected version, including dd-trace.
| Package | Affected | Fixed in |
|---|---|---|
dd-trace npm | From 2.0.0 | 5.131.1 |
dd-trace npm | From 2.0.0 | 5.131.1 |
dd-trace npm | From 6.0.0 | 6.20.1 |
dd-trace npm | From 6.0.0 | 6.20.1 |
How do I fix CVE-2026-116693?
Upgrade dd-trace to a fixed version for your release line: 5.131.1 or 6.20.1.
Is CVE-2026-116693 being exploited?
There is no known exploitation of CVE-2026-116693 in the wild and no public exploit code.
Sources
Also known as ECHO-e026-2188-317a, GHSA-x94g-w73q-hpcw.