One "harmless" validation regex took the endpoint from 4ms to 504s: nested quantifiers
Problem
Our API validates comma-separated token lists with a single regex. A load test passed clean. Then a user pasted a 60-token list with one typo at the end, and the request never came back. nginx reported:
upstream timed out (110: Connection timed out) while reading response header from upstreamRoot cause
The pattern was:
const TOKEN_LIST = /^(\s*[\w.-]+\s*,)*\s*[\w.-]+\s*$/;The group (\s[\w.-]+\s,) can split the input at commas in many different ways, and \s inside and outside the group overlap. As long as matching succeeds, the engine picks the first way and moves on. But when the final $ fails (the trailing ! in our user's input), the engine backtracks and tries EVERY other split combination. That is exponential in the number of tokens: 60 tokens means astronomically many paths. Same input, same regex, only the failure branch hangs. This is why your tests never caught it: they tested valid inputs.
🔒 the fix — including 2 code blocks — is members-only. $1/mo unlocks everything.