Refine your search

2 vulnerabilities found for dd-trace-js by DataDog

CVE-2026-116693 (GCVE-0-2026-116693)
Vulnerability from cvelistv5
Published
2026-10-27 20:07
Modified
2026-10-27 20:07
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Summary
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
References
Impacted products
Vendor Product Version
DataDog dd-trace-js Version: >= 2.0.0, < 5.131.1
Version: >= 6.0.0, < 6.20.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "dd-trace-js",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 5.131.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.20.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T20:07:01.195Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/pull/10675",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/pull/10675"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x94g-w73q-hpcw",
        "discovery": "UNKNOWN"
      },
      "title": "dd-trace: ReDOS in URL query string obfuscation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116693",
    "datePublished": "2026-10-27T20:07:01.195Z",
    "dateReserved": "2026-10-26T20:00:59.830Z",
    "dateUpdated": "2026-10-27T20:07:01.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50272 (GCVE-0-2026-50272)
Vulnerability from cvelistv5
Published
2026-07-17 20:28
Modified
2026-07-21 02:19
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0.
References
Impacted products
Vendor Product Version
DataDog dd-trace-js Version: < 5.100.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T02:18:52.275989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T02:19:01.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dd-trace-js",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.100.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs, or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against any HTTP service with baggage propagation enabled. This issue is fixed in version 5.100.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T20:28:21.250Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-wxqq-gcq8-c443"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/pull/8255",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/pull/8255"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/a7d4c0da05f67cde05a99272b725a317c461d0e6"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.100.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wxqq-gcq8-c443",
        "discovery": "UNKNOWN"
      },
      "title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50272",
    "datePublished": "2026-07-17T20:28:21.250Z",
    "dateReserved": "2026-06-04T16:26:05.984Z",
    "dateUpdated": "2026-07-21T02:19:01.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}