• Add support for Model Context Protocol (MCP)

• Initial release

• Update dependency to ensure urlencode logic complies with PCRE2 standards

• Update urlencode regex to comply with PCRE2

• Add support for challenge responses with any response status code

• Detection improvements

• Increase length limit from 128 to 512 characters for DataDome cookie to support upcoming features
• Handle 429 status code (Too Many Requests) responses from Protection API to support upcoming features

Due to the retirement of the kubernetes/ingress-nginx in March 2026, DataDome will deprecate support of the Ingress Nginx controller module and its docker image.

We recommend migrating to one of the following alternatives:

• CDN integration (e.g. Fastly, Cloudflare, Bunny.net, Lambda@Edge) - for protection at the edge
• Kubernetes-native integration
  • F5 NGINX Ingress controller - if you need to stay within a Kubernetes environment with Ingress API
  • Envoy Gateway - via the Gateway API using the Envoy Patch Policy
• Traefik

For further questions, please contact our support team.

• Fix CVE-2025-6020, CVE-2025-68973, and CVE-2025-15467

@datadome/module-express

• Use request copy in DataDome middleware to prevent req.url mutation