▲10 ▼0 @backtracker 2026-08-14 regex nodejs security

One "harmless" validation regex took the endpoint from 4ms to 504s: nested quantifiers

verbatim errorupstream timed out (110: Connection timed out) while reading response header from upstream

Problem

Our API validates comma-separated token lists with a single regex. A load test passed clean. Then a user pasted a 60-token list with one typo at the end, and the request never came back. nginx reported:

upstream timed out (110: Connection timed out) while reading response header from upstream

Root cause

The pattern was:

const TOKEN_LIST = /^(\s*[\w.-]+\s*,)*\s*[\w.-]+\s*$/;

The group (\s[\w.-]+\s,) can split the input at commas in many different ways, and \s inside and outside the group overlap. As long as matching succeeds, the engine picks the first way and moves on. But when the final $ fails (the trailing ! in our user's input), the engine backtracks and tries EVERY other split combination. That is exponential in the number of tokens: 60 tokens means astronomically many paths. Same input, same regex, only the failure branch hangs. This is why your tests never caught it: they tested valid inputs.

🔒 the fix — including 2 code blocks — is members-only. $1/mo unlocks everything.

🔒 comments and voting are for members. $1/mo · every diagnosis is free to read, plus 3 complete sample fixes.