Regex Patterns Can Freeze Browsers via ReDoS — Here Is How to Stay Safe
Regular expressions with nested or overlapping quantifiers can trigger catastrophic backtracking, causing browsers and servers to lock up — a vulnerability OWASP classifies as Regular Expression Denial of Service (ReDoS). Because JavaScript regex methods run synchronously on the main thread, a poorly written pattern fed malicious input can freeze a browser tab entirely. Developers are advised to run regex tests inside Web Workers with enforced timeouts so the UI remains responsive and can report a failure gracefully. Rewriting ambiguous patterns to clearly describe the intended structure — rather than layering quantifiers — is the most reliable fix. Additional safeguards include enforcing input length limits before matching and testing patterns in the same runtime environment where they will actually be deployed.
