ReDoS (Regular Expression Denial of Service) is a type of attack that exploits the backtracking behavior of regex engines. By crafting a malicious input string, an attacker can cause a regex to take exponentially long to evaluate—potentially seconds, minutes, or even hours—consuming CPU resources and denying service to legitimate users. This is especially dangerous on server-side applications where a single slow regex can block the entire event loop or thread pool.

The most common dangerous patterns include:

1. Nested quantifiers: (a+)+, (x*)*, (.+){2,}
2. Overlapping alternation: (a|aa|aaa)+b — where branches can match the same characters
3. Quantified optional groups: (x?)+, ([,-]?)+
4. Greedy quantifiers before optional parts: .*=.* on input with no =
5. Multiple overlapping .* patterns: .*.*.*

The common trait: exponential backtracking when the regex engine tries all possible ways to split the match.

This tool uses a two-pronged approach:

1. Static Analysis: Scans the regex pattern for known dangerous structures (nested quantifiers, overlapping alternation, etc.) using pattern-matching rules.

2. Safe Execution Test: Runs the regex against an auto-generated attack string inside a sandboxed Web Worker with a 5-second timeout. If the worker is terminated due to timeout, it confirms a severe ReDoS vulnerability. If it completes, the execution time is measured and compared against safe thresholds.

The combination of static analysis and empirical testing provides a comprehensive vulnerability assessment.