Datadog dd-trace EUVD-2026-111384

The target must be a Node.js app using dd-trace 2.0.0-<5.131.1 or 6.0.0-<6.20.1 with an affected HTTP tracing integration that records query strings in URL span tags - this uses the vulnerable default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP and is enabled by DEFAULT, so no non-standard configuration is required. The attacker needs only to reach an instrumented HTTP endpoint and control a URL query string (PR:N/UI:N). Limiting factors: exploitation is neutralized if the operator has already overridden DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP with the fixed pattern the advisory provides (and restarted), or if query-string capture in URL span tags is disabled; impact is confined to availability (CPU/event-loop stall) with no data exposure.

This is a genuine but bounded availability risk. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is internally consistent with the description: the vulnerable obfuscation regex is applied synchronously to attacker-controlled URL query strings over the network, with no authentication, no user interaction, and low complexity - so the trigger is easy to reach remotely. Impact is strictly availability (VA:H; VC:N/VI:N) - a ReDoS (CWE-1333) that burns CPU and stalls Node.js request processing, with no confidentiality or integrity consequence. The vuln.today Decision label is 'this_week' (prioritize, but not emergency). Signals are partly missing rather than conflicting: no EPSS exploitation-probability score is provided, the CVE is NOT in CISA KEV, and the GHSA advisory deliberately omits triggering inputs and reproduction steps, so no public exploit is identified. Net: a real high-severity DoS worth patching within the vendor-suggested week, but it is a single-event-loop stall rather than a confirmed, widely-weaponized threat - treat as availability-priority, not data-breach-priority.

An attacker sends HTTP requests with a specially crafted query string to any endpoint of a Node.js application instrumented with an affected dd-trace HTTP integration. Because the default query-string obfuscation regex is applied synchronously on the event loop while recording URL span metadata, the crafted input triggers catastrophic backtracking, pinning CPU and stalling all request processing until the application is effectively unavailable. No proof-of-concept or working exploit code is identified at time of analysis; the advisory withholds the triggering inputs.