The regex shapes that hang your program — why they blow up, the exact input that kills each one, and the safe rewrite.
Every "vulnerable" example below was reproduced by redosray with a real, measured hang in an isolated worker. Proven, not guessed. The "safe" examples look scary but genuinely aren't — and redosray correctly leaves them alone.
Catastrophic backtracking (a.k.a. ReDoS — Regular-expression Denial of Service) happens when a backtracking regex engine explores an exponential or polynomial number of ways to match a crafted string. A single request with a few dozen characters can pin a CPU core for seconds, minutes, or forever. It's caused real outages (Cloudflare, Stack Overflow) and it hides in innocent-looking validators.
The trap: static analyzers flag any nested/adjacent quantifier and drown you in false positives, so people stop trusting them. redosray takes a different route — it finds candidate shapes statically, then actually runs each one against a generated attack string and escalates the length until the match crosses a timeout. If nothing hangs, it says nothing. So the report is short and every entry comes with the input that proves it.
The textbook case. An inner quantifier is nested inside an outer one, so the engine can split the same run of characters an exponential number of ways before it gives up.
/^(a+)+$/For each added a that doesn't let the whole string match (append one non-a), the work roughly doubles.
a + !, 27 chars). Timing climbs 11ch→0.2ms, 17ch→7ms, 27ch→timeout >1000ms — textbook doubling./^a+$/There was never a reason to nest here. When you genuinely need groups, make each character consumable exactly one way (atomic groups / possessive quantifiers where supported, or restructure so the sub-patterns can't overlap).
Prove it live →The two branches of an alternation can match the same characters, and the whole thing is quantified. The engine has multiple equal ways to consume each character.
/(x+x+)+y/x with no trailing y forces the engine to try every partition of the xs across the two x+ groups and the outer + — confirmed hang on a 27-char input./x+y/Collapse redundant, overlapping quantifiers. If branches must differ, make them mutually exclusive (e.g. anchor on distinct first characters) so only one can match at each position.
Prove it live →This shape shows up in the wild constantly — copied from tutorials and Stack Overflow into signup forms. A quantified group whose body is itself a quantifier over an overlapping character class.
/^([a-zA-Z0-9])(([\.\-]?[a-zA-Z0-9]+)*)@/The inner [\.\-]?[a-zA-Z0-9]+ repeated with * can partition a run of alphanumerics ambiguously; feed it a long local-part with no @ and it detonates.
"a1a1a1…" (28 chars, no @) — 18ch→9ms, then it crosses the timeout. The killer is that real signups pass user-controlled strings straight into this./^[a-z0-9]+([._-][a-z0-9]+)*@/iRequire a separator before each repeated chunk so the partition is unique — there's exactly one way to split the input. (redosray confirms this rewrite is safe: no candidate hangs.) Better still, don't validate email with a regex; check for one @ and send a confirmation.
Matching a tag with [^>]* repeated inside a group is a famous foot-gun — the pattern family behind well-known production regex outages.
/<([a-z]+)([^>]*)*>/([^>]*)* is a quantifier over a quantifier of the same class. Feed it <a followed by many characters and no closing >.
> — 18ch→22ms, then timeout. Nested star over [^>]* is the tell./<([a-z]+)([^>]*)>/Drop the outer * — a single [^>]* already matches "everything up to >" greedily and unambiguously.
This is where redosray earns its keep. Static-only tools flag all of these because they contain nested/adjacent quantifiers — but a backtracking engine matches them in linear time, so flagging them is a false positive that trains people to ignore the tool.
| Pattern | Why it's fine |
|---|---|
| /^(.*,)*.*$/ | The .*s don't create catastrophic ambiguity here; confirmed no hang up to 100k+ chars. |
| /^\d+$/ | A single quantifier over a class — nothing to backtrack. |
| /^[a-z0-9]+([._-][a-z0-9]+)*$/ | The mandatory separator makes every split unique (the safe email shape). |
redosray runs each candidate before reporting. If it can't make it hang, it stays quiet. That means the vulnerabilities it does report are worth acting on.
Check it live →You don't need to memorize shapes. But these five habits prevent almost all ReDoS:
(a+)+, (a*)*, ([^x]*)*.([._-][a-z0-9]+)*, not ([._-]?[a-z0-9]+)*).regex) for untrusted input where you can.npx redosray . or the GitHub Action.# scan your whole repo, exit non-zero on any *proven* vulnerability
npx redosray . --ci