Skip to content
OpenAdvisories

Package · npm

dd-trace

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.7
    CVE-2026-116693

    dd-trace: ReDOS in URL query string obfuscation

    dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously whil…

    Datadog dd-trace-js dd-trace npm
  • High 7.5
    CVE-2026-50272

    dd-trace: Improper parsing of W3C baggage headers may lead to DoS

    dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE…

    Datadog dd-trace-js dd-trace npm