dd-trace: ReDOS in URL query string obfuscation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.131.1, 6.20.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The dd-trace library, Datadog's application performance monitoring client for Node.js, is affected. A specially crafted URL query string sent to an application using it can cause excessive CPU use during request tracing, stalling request processing and making the application unavailable.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- DataDog dd-trace-js
From 2.0.0 · fixed in 5.131.1; From 6.0.0 · fixed in 6.20.1
- dd-tracenpm
From 2.0.0 · fixed in 5.131.1
- dd-tracenpm
From 6.0.0 · fixed in 6.20.1