A regex that works correctly under normal inputs can pin a CPU at 100% when a crafted input triggers catastrophic backtracking. The attack class is CWE-1333 — ReDoS, regular expression denial of service. The runtime doesn't matter: Node.js, Python, Java, Ruby, all use backtracking-based engines. What matters is whether the pattern itself creates an exponentially growing search space on a non-matching input.
This tutorial walks through what catastrophic backtracking looks like, how to detect it before it ships, and how to wire the check into a CI/CD gate so it runs automatically on every changeset.
Everything here runs against ReDoScan — a REST API I built for this specific job. There's also a free web checker if you want to paste a regex without writing code. I built both; I'll be upfront about that throughout.
What catastrophic backtracking actually is
Most regex engines work by trying every possible path through the pattern when a match fails. For safe patterns the search space is small — the engine finds a dead-end quickly and moves on. For certain constructs the search space grows exponentially with input length, and a crafted non-matching input can force the engine to explore it all.
