CVE-2026-116693: CVE-2026-116693: Regular Expression Denial of Service in Datadog Node.js Tracer (dd-trace)

#security #cve #cybersecurity

CVE-2026-116693: Regular Expression Denial of Service in Datadog Node.js Tracer (dd-trace)

Vulnerability ID: CVE-2026-116693
CVSS Score: 8.7
Published: 2026-10-27

CVE-2026-116693 is a high-severity Regular Expression Denial of Service (ReDoS) vulnerability affecting the official Datadog Application Performance Monitoring (APM) client library for Node.js, dd-trace. The defect resides in the default regular expression defined by the DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP configuration parameter, which is used to sanitize incoming and outgoing HTTP URL query strings prior to recording trace span metadata. Due to overlapping sub-patterns and unanchored repetition blocks in the JSON Web Token (JWT) and URL-encoded string matching branches, the V8 JavaScript engine's regular expression subsystem (Irregexp) can be forced into catastrophic or high-degree polynomial backtracking. Because regular expression replacement occurs synchronously on the primary Node.js event loop, an unauthenticated remote attacker can send crafted HTTP requests with malicious query strings to consume 100% of the process CPU core, stalling concurrent request processing and rendering the application unavailable.

TL;DR

An inefficient default regular expression used by the Datadog Node.js APM tracer (dd-trace) to redact sensitive parameters from URL query strings allows unauthenticated attackers to trigger catastrophic backtracking via crafted HTTP requests, blocking the Node.js single-threaded event loop and causing a full application denial of service.

Technical Details

CVE ID: CVE-2026-116693 (GHSA-x94g-w73q-hpcw)
Vulnerability Class: CWE-1333: Inefficient Regular Expression Complexity (ReDoS)
Affected Component: dd-trace (npm) URL Query String Obfuscator (obfuscateQs)
Attack Vector: Network (Unauthenticated HTTP/HTTPS Requests)
CVSS v4.0 Score: 8.7 High (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
Security Impact: Node.js Event Loop Starvation / Application Denial of Service
Patched Versions: 5.131.1, 6.20.1
CISA KEV Status: Not Listed

Affected Systems

Datadog Node.js APM Tracer (dd-trace) >= 2.0.0, < 5.131.1
Datadog Node.js APM Tracer (dd-trace) >= 6.0.0, < 6.20.1
dd-trace: >= 2.0.0, < 5.131.1 (Fixed in: 5.131.1)
dd-trace: >= 6.0.0, < 6.20.1 (Fixed in: 6.20.1)

Code Analysis

Commit: 5eeee79

fix(http): update default query string obfuscation regex (v6 branch)

--- a/packages/dd-trace/src/config/supported-configurations.json
+++ b/packages/dd-trace/src/config/supported-configurations.json
@@ -3655,9 +3655,9 @@
     ],
     "DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP": [
       {
-        "implementation": "F",
+        "implementation": "I",
         "type": "string",
-        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}"
+        "default": "(?:(?:\"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|(?:bearer(?:\\s|%20)+[a-z0-9._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|(^|[^\\w%-]|%[0-9a-f]{2})ey[I-L][\\w-]+(?:=|%3D)*\\.ey[I-L][\\w-]+(?:=|%3D)*(?:\\.(?:[\\w.+/=-]|%3D|%2F|%2B)+)?|-{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY-{5}[^\\-]+-{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY(?:-{5})?(?:\\n|%0A)?|(?:ssh-(?:rsa|dss)|ecdsa-[a-z0-9]+-[a-z0-9]+)(?:\\s|%20|%09)+(?:[a-z0-9/.+]|%2F|%5C|%2B){100,}(?:=|%3D)*(?:(?:\\s|%20|%09)+[a-z0-9._-]+)?)"
       }
     ],
--- a/packages/dd-trace/src/plugins/util/url.js
+++ b/packages/dd-trace/src/plugins/util/url.js
@@ -2,6 +2,7 @@

 const { URL } = require('url')

+const { defaults } = require('../../config/defaults')
 const log = require('../../log')

 const HTTP2_HEADER_AUTHORITY = ':authority'
@@ -55,12 +56,15 @@ function obfuscateQs (config, url) {

   let qs = url.slice(i + 1)

-  qs = qs.replace(queryStringObfuscation, '<redacted>')
+  // Group 1 of the default regex is the delimiter in front of a JWT. A user-provided regex may capture the secret.
+  const replacement = queryStringObfuscation === defaultQsObfuscator ? '$1<redacted>' : '<redacted>'
+  qs = qs.replace(queryStringObfuscation, replacement)

   return `${path}?${qs}`
 }

 const qsObfuscatorCache = new Map()
+let defaultQsObfuscator

 /**
  * Compile the configured query-string obfuscator (a regex string, or a boolean)
@@ -85,6 +89,7 @@ function getQsObfuscator (config) {
     } else if (obfuscator !== '.*') { // '.*' optimizes to a full redact (true)
       try {
         compiled = new RegExp(obfuscator, 'gi')
+        if (obfuscator === defaults.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP) defaultQsObfuscator = compiled
       } catch (err) {
         log.error('Error getting qs obfuscator', err)
       }

Commit: cf4e68a

fix(http): update default query string obfuscation regex (v5 branch)

Mitigation Strategies

Upgrade the dd-trace npm package to version 5.131.1 or 6.20.1 (or later) to incorporate the anchored regular expression and updated replacement logic.
Override the DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP environment variable with the lookbehind-hardened regular expression pattern if an immediate code upgrade is not possible.
Set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP='.*' to enable fast-path full query string redaction without regular expression evaluation.
Restrict maximum allowed URL and query string lengths at the reverse proxy, ingress controller, or Web Application Firewall (WAF) layer to limit the maximum input size reaching the Node.js process.

Remediation Steps:

Audit all Node.js repositories and container images (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml) to identify instances of dd-trace between versions 2.0.0 and 5.131.0, or between 6.0.0 and 6.20.0.
Update the dependency specification in package.json to ^5.131.1 or ^6.20.1 and regenerate lockfiles using npm install or yarn up.
If immediate redeployment is blocked, configure the runtime environment variable DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP with the Datadog-provided lookbehind regex string and restart the Node.js service.
Verify in staging or production APM traces that query string sanitization continues to redact sensitive tokens without degrading event loop lag metrics.

References

Read the full report for CVE-2026-116693 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community