CVE-2026-116693: 
JavaScript vulnerability analysis and mitigation

CVE-2026-116693 is a Regular Expression Denial of Service (ReDoS) vulnerability in dd-trace, the Datadog APM client for Node.js. The default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP regular expression can perform excessive backtracking when processing attacker-controlled URL query strings, enabling unauthenticated remote attackers to cause denial of service. Affected versions span from 2.0.0 through 5.131.0 and 6.0.0 through 6.20.0; fixed versions are 5.131.1 and 6.20.1. The vulnerability was published on October 27, 2026, with a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), also mapped to CAPEC-492 (Regular Expression Exponential Blowup). The vulnerable regex is the default value of the DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP configuration option, which is applied synchronously within the HTTP tracing integration when recording URL metadata. Because the pattern evaluation occurs on the request-handling thread without any timeout or asynchronous offloading, a crafted query string can trigger catastrophic backtracking, monopolizing CPU for an extended period. No authentication or special privileges are required; any network-accessible HTTP endpoint instrumented by the affected dd-trace versions is exploitable (GitHub Advisory, Fix PR #10675).

Successful exploitation causes a denial-of-service condition by consuming excessive CPU on the Node.js application server, stalling request processing and rendering the instrumented application unavailable to legitimate users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any Node.js service using an affected version of dd-trace with HTTP tracing enabled is within scope, and a sustained attack could fully block request handling for the duration of the malicious input processing (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no user interaction, and no special configuration — an attacker only needs network access to an HTTP endpoint of an instrumented application, making the attack surface broad and the barrier to exploitation low (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Node.js applications instrumented with dd-trace versions 2.0.0–5.131.0 or 6.0.0–6.20.0 that expose HTTP endpoints. This can be done via HTTP response headers, error messages, or known deployment information.
2. Craft malicious query string: Construct a URL query string designed to trigger catastrophic backtracking in the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP pattern — for example, a long string of characters that partially matches sensitive-parameter patterns (e.g., repeated password-like substrings with ambiguous delimiters) without completing a full match.
3. Send crafted HTTP request: Submit the malicious request to any HTTP endpoint of the target application (e.g., GET /api/endpoint?password%3D=aaaaaa...aaaa! with a sufficiently long payload).
4. Trigger CPU exhaustion: The dd-trace HTTP plugin applies the regex synchronously during URL metadata recording; the backtracking causes the Node.js event loop to stall, blocking all subsequent request processing.
5. Sustain denial of service: Repeat requests at a rate sufficient to keep the CPU saturated, maintaining the application in an unavailable state (GitHub Advisory, Fix PR #10675).

• Network: Unusual volume of HTTP requests with abnormally long or structurally repetitive query strings targeting any endpoint of the instrumented application; requests containing repeated patterns resembling credential parameter names (e.g., password, token, secret) with no legitimate value.
• Process: Node.js process CPU usage spiking to near 100% sustained over time; event loop lag metrics (if monitored) showing extreme delays correlated with specific incoming requests.
• Logs: Application logs showing request timeouts or dropped connections immediately following receipt of requests with long query strings; dd-trace debug logs (if enabled) showing regex evaluation activity on suspicious query strings.
• APM Metrics: Datadog APM traces showing abnormally high span durations for HTTP server spans coinciding with the malicious requests, or gaps in trace data due to event loop stalls.

Upgrade dd-trace (npm package) to version 5.131.1 or 6.20.1, which replace the vulnerable default regex with a backtracking-safe equivalent (v5.131.1 Release, GitHub Advisory). As an immediate workaround without upgrading, set the environment variable DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed regex provided in the advisory and restart the application — this overrides the vulnerable default pattern. Organizations unable to act immediately should consider placing a WAF or reverse proxy in front of affected services to reject or truncate abnormally long query strings.

The vulnerability was disclosed via a GitHub Security Advisory by Datadog contributor mmuller-dd on October 8, 2026, and the fix was merged via PR #10675 authored by CarlesDD. The advisory received automated coverage from vulnerability tracking services including VulnDB, OSV, and ENISA EUVD shortly after publication. Social media activity was limited to automated CVE broadcast accounts on Mastodon (infosec.exchange) and Bluesky, with no notable independent researcher commentary or media coverage identified.