hardBackend

What is a ReDoS (Regular Expression Denial of Service) attack and how do you avoid it?

Q: What is a ReDoS (Regular Expression Denial of Service) attack and how do you avoid it?

**TL;DR.** A **ReDoS** exploits a regex with **catastrophic backtracking**: crafted input makes the engine try exponentially many paths, **pinning the single event-loop thread** and freezing the whole process. Avoid it with **linear-time patterns**, **input length limits**, **safe-regex linting**, or a non-backtracking engine like **RE2**. (a+)+$ on "aaaa…aaa!" backtracking

1.0k views

Understand the problem

Catastrophic backtracking blocking the event loop.

nodejssecurityredosregex

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Risky pattern → safer approach

// ❌ catastrophic backtracking on "aaaaaaaaaaaaaaaa!"
const evil = /^(a+)+$/;

// ✅ simple linear pattern + input cap
if (input.length > 256) throw new Error('input too long');
const safe = /^a+$/;

// ✅ or use RE2 for untrusted input (no backtracking)
// import RE2 from 're2'; new RE2('(a+)+$').test(input);

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

Explain how memory management and Garbage Collection work in the V8 engine.

What is diagnostics_channel and when would you use it?