Regex ReDoS Vulnerability Detector

The Regex ReDoS Vulnerability Detector checks a regular expression for catastrophic backtracking — the class of bug (Regular Expression Denial of Service, or ReDoS) where a pathological pattern takes exponentially longer to fail on certain input than it does to succeed, hanging whatever process runs it. It runs two independent checks, both entirely in your browser.

How it works

Static analysis. As you type a pattern, the tool parses its structure and calculates every distinct path an input string could take through it. If two or more paths can match the same input, the regex engine may have to try every combination before giving up — that ambiguity is what produces exponential backtracking. The tool reports a backtrack score (higher means more ways the engine can backtrack; a score of 1 means none can occur) and highlights the specific fragments of your pattern where paths overlap.

Dynamic timing test. Press Run timing test to actually execute the pattern, off the main thread in a Web Worker, against two auto-generated inputs: a "safe" input built from a filler character your pattern is likely to accept, and an "evil" input — the same filler repeated, followed by one character chosen not to match — the classic way to force a vulnerable pattern to explore every possible split before failing. The table shows how long each took. If a pattern is genuinely catastrophic, the evil input can hang indefinitely; the test gives up after 5 seconds and reports that as strong practical evidence of the vulnerability, since your server would hang the same way.

Adjust the Evil input length slider to make the effect more (or less) dramatic — a truly catastrophic pattern's evil-input time roughly doubles with every extra character, so even a few characters' difference can turn a barely-noticeable delay into a multi-second hang.

How to use it

1. Enter a JavaScript regular expression pattern (without the surrounding slashes).
2. Toggle the i/m/s/u flags to match how you actually use the pattern.
3. Read the severity badge and backtrack score — Safe, Potentially vulnerable, or Critical.
4. If flagged, check the fragment table to see exactly which parts of the pattern overlap, and the safer-alternative suggestions underneath.
5. Press Run timing test to confirm the risk empirically, not just structurally.

What's a "catastrophic" pattern, concretely?

The classic shape is a quantified group nested directly inside another quantifier, like (a+)+ or (\d*)+ — for a string of n repeated characters that ultimately fails to match, the engine can end up trying roughly 2^n different ways to split the repetitions before giving up. Overlapping alternation ((a|a)+) causes the same problem without a nested quantifier in sight.

Does this run on your servers?

No — both the static analysis and the dynamic timing test run entirely in your browser. Your pattern and generated test strings are never sent anywhere.

I just want to test a pattern against real text, not check its performance

Use the Regex Tester instead — it matches your pattern against sample text and reports every match, position, and capture group. It intentionally doesn't test for backtracking performance, which is what this tool is for. To understand what a pattern does structurally, see the Regex Explainer.