Most recent entries from all

CLEANSTART-2026-BZ63180 — dd-trace is the Datadog APM client for Node

2026-11-06T18:23:20.161759+00:00

Affected: CleanStart: langfuse, CleanStart: langfuse-worker

CVE-2026-116693 affects multiple packages. dd-trace is the Datadog APM client for Node. See references for individual vulnerability details.

fkie_cve-2026-116693

2026-11-06T18:23:20.161877+00:00

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.

GHSA-x94g-w73q-hpcw — dd-trace: ReDOS in URL query string obfuscation

2026-11-06T18:23:20.161930+00:00

Affected: npm: dd-trace

### Summary

A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations.

### Details

The default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period.

As a workaround, set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed regex below, then restart the application.

``` DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP='(?:(?:"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\s|%20)*(?::|%3A)(?:\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|(?:bearer(?:\s|%20)+[a-z0-9._\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|(?:(?