The Cost of Regex: ReDoS, Catastrophic Backtracking, Readability and Testing Regex
A pattern with nested quantifiers, overlapping alternation or adjacent .* makes an exponential or polynomial number of attempts on an input that almost matches; in our measurement ^(a+)+$ took 10 seconds at 28 letters in .NET and 0.07 ms with NonBacktracking. We recognize dangerous constructs with PCRE2 step counts and cover Cloudflare's 2019 outage, the Angular validator and server validation, readable patterns with (?x), a test table with xUnit [Theory] and the MailAddress decision for email.
15 Nov 2026
·
15 min
·
5
