A single pattern in a validator can pin a Node process when the input is crafted to fail. Here is why it happens, how to spot it, and how to fix it.
A regular expression that works on every normal input can still take a server down, because the damage depends on the shape of the pattern and on one kind of hostile input, not on traffic. The engine in Node and in browsers tries alternatives one after another, and for some patterns the number of alternatives doubles with every extra character. A text that fails to match is the worst case, since the engine will not give up until it has explored every way of splitting the text. A visitor who sends one long, almost-valid string can keep a process busy for minutes. Below you will find the mechanism, the pattern shapes that cause trouble, rewrites that leave the accepted set untouched, and a…
Read the full report on AISkills402: https://aiskills402.com/blog/redos-regex-locks-server?utm_source=devto&utm_medium=social
