SZB-e5e7bba735
EUVD-2026-111384 reports excessive regex backtracking in dd-trace-js
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Datadog
- Product
- dd-trace-js
- First seen
Summary
The EUVD listing says the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP in dd-trace-js from 2.0.0 until 5.131.1 and 6.20.1 can backtrack excessively on attacker-controlled query strings. It assigns a CVSS v3.1 score of 8.7.
If you use Datadog
Upgrade dd-trace-js to 5.131.1, 6.20.1, or a later release
Override DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP with a safer pattern if you cannot upgrade immediately
Monitor APM services for unusual CPU use on query-heavy endpoints
What the sources say 1
· Mastodon: “From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings.” Source