How to Detect and Fix Catastrophic Backtracking in JavaScript Regexes

A developer maintaining CodeSwap, a browser-based developer-tools site, documented a repeatable audit process for identifying JavaScript regular expressions vulnerable to ReDoS, or Regular Expression Denial of Service attacks. The core risk arises when nested or overlapping quantifiers allow the regex engine to explore an exponentially growing number of match paths before rejecting a crafted input. Testing the pattern /^(a+)+$/ with incrementally longer hostile strings revealed that every two additional characters roughly quadrupled processing time, reaching over six seconds for just 30 characters. OWASP identifies nested quantifiers and overlapping alternatives inside repetition as key warning signs of this vulnerability. The recommended fix is to eliminate ambiguous repetition — for example, replacing /^(a+)+$/ with /^a+$/ — and to always test suspicious patterns in an isolated environment using short, controlled inputs rather than on a live request thread.