Mitigating Denial of Service (ReDoS) from Inefficient Regular Expressions in JavaScript

The Danger of Catastrophic Backtracking

Regular expression engines in V8 evaluate patterns using Nondeterministic Finite Automata (NFA). When patterns contain nested quantifiers evaluated against non-matching input strings, the computation time grows exponentially (e.g. 2^n steps), freezing the entire Node.js event loop.

Vulnerable vs Safe Regex Example

// VULNERABLE: Catastrophic backtracking on input like "aaaaaaaaaaaaaaaaaaaaaaaaaaaa!"
const badRegex = /^([a-zA-Z0-9]+)*$/;

// SAFE: Atomic group or non-overlapping character classes
const safeRegex = /^[a-zA-Z0-9]+$/;

Use static analysis tools like eslint-plugin-regexp to flag backtracking hazards in pull requests.