dd-trace-js vulnerabilities

2 known vulnerabilities in dd-trace-js from DataDog. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  dd-trace-js: Inefficient Regular Expression Complexity

  CVE-2026-116693Oct 27, 2026DataDog

  dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while

• 7.5 High severity

  dd-trace-js: Allocation of Resources Without Limits or Throttling

  CVE-2026-50272Jul 17, 2026DataDog

  dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_