# Regular Expression Denial of Service (ReDoS)

> Detects catastrophically backtracking regular expressions applied to user-controlled input, causing CPU-intensive denial of service.

- Skill: `zakirkun/regular-expression-denial-of-service-redos` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/regular-expression-denial-of-service-redos`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/regular-expression-denial-of-service-redos/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/regular-expression-denial-of-service-redos

---


# Regular Expression Denial of Service (ReDoS)

## Overview
Certain regex patterns with nested quantifiers (e.g., `(a+)+`, `(a|aa)+`, `([a-zA-Z]+)*`) cause catastrophic backtracking when matched against specially crafted inputs. A single request with a malicious string can cause the regex engine to run for seconds, minutes, or hours, exhausting server CPU.

Classic vulnerable patterns:
- `(a+)+` — exponential backtracking
- `([a-z]+)*` — polynomial backtracking  
- `(a|a?)+` — ambiguous alternation

## Detection Strategy
Look for regular expressions with:
- Nested quantifiers: `(x+)+`, `(x*)*`
- Alternation inside quantifiers: `(a|b|ab)+`
- Applied to user-controlled strings

## Remediation
- Rewrite regex to avoid ambiguous patterns
- Use linear-time regex engines (RE2 via `re2` npm package or Go's `regexp`)
- Apply regex only to length-limited input
- Use `timeout` options where available

**Vulnerable:**
```js
const emailRegex = /^([a-zA-Z0-9])(([a-zA-Z0-9])*([._-])?)+@.../;
req.body.email.match(emailRegex); // ReDoS with crafted email
```