Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-017

Regex Denial of Service (ReDoS) — catastrophic backtracking

mediumJavaScript / TypeScriptCWE-1333CVSS 5.9

What it detects

Regex patterns with nested quantifiers may cause exponential backtracking on crafted input.

How to fix

Never construct regexes from user input. Use a safe regex library or validate input first.

Vulnerable — Shield flags thissearch.js
const express = require("express");
const app = express();
const PRODUCTS = require("./products.json");

app.get("/search", (req, res) => {
  // ?q=(a+)+$ hangs the event loop on a crafted product name
  const matcher = new RegExp(req.query.q, "i");
  res.json(PRODUCTS.filter((p) => matcher.test(p.name)));
});
Fixed — scans cleansearch.js
const express = require("express");
const app = express();
const PRODUCTS = require("./products.json");

app.get("/search", (req, res) => {
  const q = String(req.query.q).toLowerCase();
  res.json(PRODUCTS.filter((p) => p.name.toLowerCase().includes(q)));
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-017, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-017: Regex Denial of Service (ReDoS) — catastrophic backtracking — Zennoxa Shield