🔍 ReDoS Scanner
Scan regular expressions for catastrophic backtracking vulnerabilities — detect dangerous patterns, generate attack strings, and measure matching performance.
About this tool
ReDoS (Regular Expression Denial of Service) is a vulnerability where specially crafted input causes a regex engine to enter catastrophic backtracking, consuming CPU exponentially and potentially freezing the server or browser.
This scanner analyzes the structure of your regex for known dangerous patterns — nested quantifiers like (a+)+, overlapping alternations like (a|aa)+, and quantified lookaheads. For each pattern found, it generates a sample attack string and measures how long the regex takes to process it.
Example: the regex (a+)+b looks innocent, but on input aaaaaaaaaaX the engine tries every possible way to split the ten "a"s across the inner and outer quantifiers before concluding "b" is absent — over a thousand attempts for just 10 characters, and millions for 20.
FAQ
What makes a regex vulnerable to ReDoS? ›
The key ingredient is a quantifier over a sub-expression that overlaps with itself — like (a+)+, (a*)*, or (a|aa)+. When the regex fails to match, the backtracking engine explores every possible split of the input, which grows exponentially with input length.
How do I fix a ReDoS-vulnerable regex? ›
Several strategies: (1) Unwrap nested quantifiers — e.g., (a+)+ becomes a+. (2) Use atomic groups (?>…) which prevent backtracking once matched. (3) Use possessive quantifiers (a++) where the engine supports them. (4) Restructure alternations to avoid overlapping choices — e.g., (a|aa)+b can be rewritten as a+(?:aa)*b.
Is this scanner guaranteed to find all ReDoS vulnerabilities? ›
No. This scanner checks for the most common structural anti-patterns. Some ReDoS vulnerabilities arise from subtle interactions between multiple parts of a regex or depend on specific inputs. It is a useful first-pass tool, not a formal verifier. For critical applications, also test your regex against adversarial inputs with a timeout.
Why does this tool cap attack strings at 30 characters? ›
To keep your browser responsive. Long attack strings can cause the regex engine to run for seconds or minutes — this scanner limits input length so timing measurements are safe and informative without freezing the page.