Dd Trace Js
Monthly
A regular-expression denial of service exists in the Datadog APM client for Node.js (dd-trace-js) versions 2.0.0 through 5.131.0 and 6.0.0 through 6.20.0, where the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can backtrack excessively on attacker-controlled URL query strings. Because the pattern runs synchronously while recording HTTP URL span metadata - and is enabled by default for affected HTTP tracing integrations that capture query strings - an unauthenticated remote attacker who can reach an instrumented endpoint and supply a crafted query string can pin the CPU and stall request processing, degrading or taking down the instrumented application. Impact is confined to availability with no data exposure; no public exploit has been identified at time of analysis, and vendor fixes ship in dd-trace 5.131.1 and 6.20.1.
A regular-expression denial of service exists in the Datadog APM client for Node.js (dd-trace-js) versions 2.0.0 through 5.131.0 and 6.0.0 through 6.20.0, where the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can backtrack excessively on attacker-controlled URL query strings. Because the pattern runs synchronously while recording HTTP URL span metadata - and is enabled by default for affected HTTP tracing integrations that capture query strings - an unauthenticated remote attacker who can reach an instrumented endpoint and supply a crafted query string can pin the CPU and stall request processing, degrading or taking down the instrumented application. Impact is confined to availability with no data exposure; no public exploit has been identified at time of analysis, and vendor fixes ship in dd-trace 5.131.1 and 6.20.1.