Go to packages list

dd-trace

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 3 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
2vulnerabilities
  • Critical0 (0.0%)
  • High2 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (2)

Known vulnerabilities affecting dd-trace, based on data from OSV.

Vulnerabilities affecting dd-trace
IDSeveritySummaryAffected versionsPublishedSource
GHSA-x94g-w73q-hpcwHighdd-trace: ReDOS in URL query string obfuscation### Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. ### Details The default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed re
  • >= 2.0.0, < 5.131.1
  • >= 6.0.0, < 6.20.1
GitHub (opens in a new tab)
GHSA-wxqq-gcq8-c443Highdd-trace-js: Improper parsing of W3C baggage headers may lead to DoS### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounde
  • < 5.100.0
GitHub (opens in a new tab)
  • GHSA-x94g-w73q-hpcwHigh
    dd-trace: ReDOS in URL query string obfuscation
    • >= 2.0.0, < 5.131.1
    • >= 6.0.0, < 6.20.1
    GitHub (opens in a new tab)

    ### Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. ### Details The default query-string obfuscation pattern can exhibit excessive backtracking. The pattern is applied synchronously when recording HTTP URL metadata, allowing query-string processing to occupy application resources for an extended period. As a workaround, set DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP to the fixed re

    CVE: CVE-2026-116693

  • GHSA-wxqq-gcq8-c443High
    dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
    • < 5.100.0
    GitHub (opens in a new tab)

    ### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounde

    CVE: CVE-2026-50272

Showing 1-2 of 2 vulnerabilities