Total ReDoS: The Dangers of regex in JavaScript
summary
JavaScript regular expressions can hit catastrophic backtracking and block the event loop: a node‑fetch URL regex forces exponential steps (Rex101 shows 12,294 → 24,582 → 49k as characters are added), a crafted Cloudflare regex causes a 27-minute outage, Superhuman’s email regex stalls the UI for ~7.3s in tests, and a Zod pattern also backtracks badly. Detection uses Rex101, regexper, redex timer, recheck or ESLint plugins; fixes are to remove overlapping quantifiers, replace with string methods (endsWith/equals) or switch to re2.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:02What is ReDoS
- 3:31Node fetch’s backtracking flaw
- 10:55Cloudflare’s outage cause
- 15:04Superhuman’s regex lockups
- 18:22Zod’s email validation flaws
- 21:14Fixing overlapping regex patterns
- 23:20Alternatives to vulnerable regexes
- 24:23Tools for ReDoS detection
related talks
38mTotal ReDoS: the Dangers of Regex in JavaScript
43mTotal ReDoS: the dangers of regex in JavaScript
31mOh no! My regex is causing a Denial of Service! What can I do about it?
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
31mService Denied! Understanding How Regex DoS Attacks Work
01h 37mTime to Use Regular Expressions More, Um, Regularly
23mLinear Matching of JavaScript Regular Expressions
29mThis DoS goes loop-di-loop – preventing DoS attacks in your Node.js application