Intermediate LevelWeb Security & Cyber Defense
What is Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking?
❓ Interview Prompt: Explain ReDoS, NFA regex engine backtracking, catastrophic exponential time complexity ($O(2^N)$), and safe regex patterns.
Regular Expression Denial of Service (ReDoS) occurs when a vulnerable regular expression containing overlapping nested quantifiers experiences Catastrophic Backtracking on non-matching user inputs:
Vulnerable Pattern:
'/(a+)+$/' tested against input 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaX'.
•
The NFA regex engine attempts $2^{30}$ possible match combinations, causing 100% CPU usage and freezing the event loop for minutes!
•
Defense: Avoid nested quantifiers ('(a+)+'), set regex execution timeouts, or use linear-time regex engines (RE2).
Code Implementation Example
typescript
import safeRegex from 'safe-regex';
const vulnerablePattern = /(a+)+$/;
console.log(safeRegex(vulnerablePattern)); // false (Detects unsafe ReDoS pattern!)
// Safe replacement without nested quantifiers:
const safePattern = /a+$/;💡Detecting unsafe ReDoS regex patterns using safe-regex.
🎯 Interview Key Takeaway
Avoid nested quantifiers in regular expressions to prevent Catastrophic Backtracking and ReDoS CPU exhaustion.
#ReDoS#Regex#Denial of Service#Intermediate
Back to all Web Security & Cyber Defense Questions→