Threats affecting pkg:npm/dd-trace

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.7		CVE-2026-116693DataDog dd-trace-js · ReDoS High8.72026-10-27CVE Database V5CVE-2026-116693 CVE-2026-116693 is a high-severity vulnerability in DataDog's dd-trace-js Node.js APM client. Versions from 2.0.0 up to but not including 5.131.1, and from 6.0.0 up to but not including 6.20.1, contain an inefficient regular expression in the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP. This flaw allows crafted URL query strings to cause excessive CPU consumption and stall request processing, potentially making the instrumented application unavailable. The issue is fixed in versions 5.131.1 and 6.20.1. Vulnerability CWE-1333	CVE Database V5	2026-10-27
High	7.5	EPSS 0.8%	CVE-2026-50272dd-trace-js · Improper parsing of W3C baggage headers may lead to DoS High7.5EPSS 0.8%2026-07-17GCVE DatabaseCVE-2026-50272 Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898... EPSS 0.8%Vulnerability CWE-400 #ghsa-wxqq-gcq8-c443 #npm	GCVE Database	2026-07-17

Page 1 of 1 · 1 duplicate CVE record merged