Regex DoS (ARCH3135)

Key typescript.security.regex-dos · Severity warning · Category security · CWE CWE-1333

Applying a regex with nested quantifiers (like (a+)+) to untrusted input causes catastrophic backtracking that stalls the event loop, enabling ReDoS.

Incorrect

app.post("/validate", (req, res) => {
  // Input "aaaa...!" pegs the CPU
  const ok = /^(\w+\s?)+$/.test(req.body.name);
  res.json({ ok });
});

Correct

app.post("/validate", (req, res) => {
  const name = String(req.body.name);
  // Linear, non-backtracking check
  const ok = name.length <= 100 && /^[\w\s]+$/.test(name);
  res.json({ ok });
});

Fix

Avoid nested quantifiers, use linear patterns, and bound the input length.