Back to All Tools
OWASP & CWE-1333 ReDoS Audit Engine

ReDoS Vulnerability & Backtracking Analyzer

Audit regular expressions for catastrophic backtracking vulnerabilities. Detect nested quantifiers (a+)+, ambiguous alternations, and benchmark execution time growth to prevent 100% CPU starvation attacks.

ReDoS (Regex Denial of Service) Vulnerability Analyzer

Backtracking Auditor

Detect catastrophic backtracking, nested quantifiers, ambiguous alternations, and calculate polynomial vs exponential time complexity.

Time Complexity:O(2ᴺ) Exponential
//
Sample Evil Regexes:

Catastrophic ReDoS Vulnerability Detected

CRITICAL RISK (Score: 15/100)

Exponential time complexity O(2ᴺ) allows attackers to cause 100% CPU thread starvation with tiny payload strings.

Vulnerability Analysis & Remediation Plan

NESTED_QUANTIFIERSCRITICAL

Nested quantifiers detected: "(a+)+". When an inner repeated token is inside an outer repeated group, state space expands exponentially O(2ᴺ).

Fix Recommendation:Flatten nested repetitions into a single quantifier or use atomic grouping / possessive quantifiers.
Automated regex state-space analysis and safe non-blocking benchmark engine.
OWASP Top 10 A03 / CWE-1333

Catastrophic Backtracking Scan

Detects exponential O(2ᴺ) and polynomial O(N²) evaluation paths that freeze Node.js / browser event loops.

Safe Stress Benchmark

Executes bounded microsecond timing runs across increasing string lengths to visually graph and confirm backtracking runaway.

Remediation Guidelines

Provides drop-in pattern fixes, atomic grouping recommendations, and safe character class alternatives.