flawopen.com/ReDoS/JavaScript RegExp
Yes. V8 uses a backtracking engine, and JavaScript has no regex timeout. In Node.js the impact is unusually severe because the event loop is single-threaded — a single slow match does not just delay one request, it blocks every concurrent request in the process until it finishes. One HTTP request can take an entire server offline.
// Validating user input with an // ambiguous pattern const re = /^(\w+\s?)*$/; app.post('/search', (req, res) => { if (!re.test(req.body.q)) { return res.status(400).end(); } // A long run of word chars ending // in "!" hangs the event loop here. }); // Equally common: a regex applied to // a request header const ua = /(\d+\.)+\d+/.exec( req.headers['user-agent']);
// 1. Bound length before matching if (typeof q !== 'string' || q.length > 128) return res.status(400).end(); // 2. Unambiguous pattern const re = /^[\w ]{1,128}$/; // 3. For complex parsing, don't use // a regex — use a real parser, or // a linear-time engine such as // RE2 via a binding. // 4. Keep dependencies patched — // many ReDoS advisories are in // libraries, not your own code.
In a threaded server, a request stuck in a pathological regex occupies one worker thread; the rest continue serving. Node.js runs JavaScript on a single thread, and regex matching is synchronous and non-yielding. While the engine backtracks, nothing else executes — no other request handlers, no timers, no health checks.
The practical consequence is that a ReDoS in a Node service is a full availability outage triggered by one small request, and it will also cause load balancer health checks to fail, which can cascade.
Most ReDoS advisories in the npm ecosystem are against libraries rather than application code — parsers, validators, formatters, and middleware that run regexes over strings you hand them. Your own patterns may be fine while a transitive dependency is not, so npm audit and keeping packages current are doing real work here, not just box-ticking.
npm audit
ReDoS advisories are frequently rated moderate rather than high, which causes teams to defer them. For an internet-facing Node service, a reachable ReDoS is an availability vulnerability with a trivial exploit — triage accordingly.
There is no built-in timeout. Options are to run matching in a worker thread or child process you can terminate, or to use a linear-time engine such as RE2 through a native binding. Bounding input length and fixing the pattern are simpler and usually sufficient.
Yes — it freezes the tab. It is a much less serious outcome than taking down a shared server, but it is a real denial of service for the user, particularly if the pattern runs on input as the user types.
Building a regex from user input with new RegExp(userInput) is considerably worse — the attacker then supplies the pattern, not just the subject, and can construct a maximally pathological one deliberately. Avoid it entirely.