Is CVE-2026-116693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116693 being exploited in the wild.

How severe is CVE-2026-116693?

High severity, with a CVSS score of 4, published 27 October 2026.

Which products and versions are affected?

Datadog Dd-Trace 2.0.0 to 5.131.0; 6.0.0 to 6.20.0; dd-trace (npm) >= 2.0.0, < 5.131.1, SEMVER:introduced=2.0.0,fixed=5.131.1.

Is there a fix for CVE-2026-116693?

Yes. dd-trace (npm): upgrade to 5.131.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116693 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116693?

Check whether you run Datadog Dd-Trace or dd-trace (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116693: Datadog dd-trace ReDoS in query string obfuscation regex

Q: Is there a fix for CVE-2026-116693?

Yes. dd-trace (npm): upgrade to 5.131.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116693 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116693?

Check whether you run Datadog Dd-Trace or dd-trace (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116693 · Severity: high · CVSS 4 · Published 2026-10-27

Datadog's dd-trace is an application performance monitoring client for Node.js that automatically instruments and monitors web applications. A crafted URL query string can trigger excessive backtracking in the default obfuscation regex, causing the application to consume significant CPU and become unresponsive. An attacker could exploit this to launch denial-of-service attacks against applications using vulnerable versions of dd-trace.

Vendors: Datadog, npm.

Quick answers

Is CVE-2026-116693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116693 being exploited in the wild.
How severe is CVE-2026-116693?: High severity, with a CVSS score of 4, published 27 October 2026.
Which products and versions are affected?: Datadog Dd-Trace 2.0.0 to 5.131.0; 6.0.0 to 6.20.0; dd-trace (npm) >= 2.0.0, < 5.131.1, SEMVER:introduced=2.0.0,fixed=5.131.1.
Is there a fix for CVE-2026-116693?: Yes. dd-trace (npm): upgrade to 5.131.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116693 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116693?: Check whether you run Datadog Dd-Trace or dd-trace (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dd-trace (npm): upgrade to 5.131.1 or later
```
npm install dd-trace@5.131.1
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP pattern. The regex is evaluated synchronously during HTTP request processing without timeout protection, allowing an attacker-controlled URL query string to trigger catastrophic backtracking. This stalls request handling and makes the instrumented application unavailable.

Affected products

Datadog dd-trace 2.0.0 to 5.131.0; 6.0.0 to 6.20.0

Identifiers

CVE-2026-116693
GHSA-x94g-w73q-hpcw

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.