# ReDoS (Regular Expression Denial of Service) Scanner Scan one or more regex patterns for catastrophic backtracking risk, simulate evil inputs, and suggest safer rewrites > Canonical page: https://elysiatools.com/en/tools/redos-regex-scanner - **Category:** Security - **Keywords:** redos, regex, security, catastrophic backtracking, benchmark ## Overview Paste one regular expression per line and optionally set flags, maximum evil-input length, and simulation runs. The scanner uses both static heuristics and near-miss input simulation to estimate whether the pattern can degrade toward catastrophic backtracking. How to use it: - Regex List: one pattern per line, without surrounding slashes - Flags: optional JavaScript regex flags such as i, m, or u - Max Evil Input Length: longest generated near-miss attack string - Simulation Runs: how many repeated match attempts to use during benchmarking What it reports: - static anti-pattern findings - worst simulated near-miss execution time - a risk score and risk level - a safer rewrite suggestion ## Inputs - **Regex List** (textarea): (a+)+$ ^(\w+\s?)*$ - **Flags** (text) - **Max Evil Input Length** (number) - **Simulation Runs** (number) ## When to use - Auditing user-submitted regular expressions before allowing them to execute on your server. - Reviewing complex nested quantifiers in legacy codebases during security audits. - Testing input validation patterns for potential performance bottlenecks under edge-case conditions. ## How it works - Paste one or more regular expressions into the input field, one per line, without surrounding slashes. - Optionally specify JavaScript regex flags, maximum evil input length, and the number of simulation runs. - The scanner analyzes the patterns using static heuristics and generates near-miss attack strings to benchmark execution time. - Review the generated JSON report detailing risk levels, worst-case execution times, and suggested safer rewrites. ## Use cases - Securing Node.js backend APIs against ReDoS attacks by validating custom routing or input validation regexes. - Integrating into a DevSecOps workflow to statically analyze and benchmark regex patterns before deployment. - Optimizing slow-performing search or parsing scripts by identifying and rewriting inefficient regex patterns. ## Frequently asked questions ### What is catastrophic backtracking? It occurs when a regular expression engine evaluates a complex pattern against a near-miss string, causing execution time to grow exponentially and potentially crashing the application. ### How does the scanner generate evil inputs? It analyzes the regex structure to craft specific near-miss strings designed to trigger worst-case backtracking scenarios up to your specified maximum length. ### Do I need to include slashes in my regex? No, paste the raw pattern without the surrounding forward slashes (e.g., (a+)+$ instead of /(a+)+$/). ### What do the simulation runs do? The simulation runs dictate how many times the regex engine attempts to match the generated evil input, providing a reliable benchmark for execution time. ### Can this tool fix my vulnerable regex automatically? The tool provides a safer rewrite suggestion in its JSON output, but you should always test the suggested pattern to ensure it meets your specific validation requirements. ## Related tools - [Regex Cheat Sheet](https://elysiatools.com/en/tools/regex-cheat-sheet): A searchable, localized cheat sheet for regular expression syntax — character classes, anchors, quantifiers, groups & references, lookarounds, escape sequences, and flags — with a built-in quick tester - [Regex Debugger](https://elysiatools.com/en/tools/regex-debugger): Step through how a regular expression matches a string position by position: visualize match attempts, partial successes, backtracks, and captures — a learning tool for understanding regex behavior, not just the final result - [Regex Railroad Diagram Visualizer](https://elysiatools.com/en/tools/regex-railroad-diagram-visualizer): Render a regular expression as an SVG railroad (syntax) diagram showing literals, groups, alternations, and repetition, with capture-group numbering and flag explanations - [Text File Replacer](https://elysiatools.com/en/tools/text-file-replacer): Find and replace text in files with support for regex, multiple patterns, and backup creation - [Regex Tester](https://elysiatools.com/en/tools/regex-tester): Test regular expressions against text - [Text File Searcher](https://elysiatools.com/en/tools/text-file-searcher): Search for text patterns in files with advanced options (regex, case-sensitive, whole word, etc.) - [Regex Benchmark](https://elysiatools.com/en/tools/regex-benchmark): Compare performance of different regex patterns, identify bottlenecks, and detect degenerate cases - [Regex Linter](https://elysiatools.com/en/tools/regex-linter): Detect error-prone and risky regex patterns, check for catastrophic backtracking, unanchored patterns, and provide rewrite suggestions ## Samples - [Risky Regex Patterns](https://elysiatools.com/en/samples/risky-regex): Collection of regex patterns that demonstrate security vulnerabilities, performance issues, and common anti-patterns to avoid - [Regex Replace Samples](https://elysiatools.com/en/samples/regex-replace): Collection of common and useful regex replacement patterns for text transformation and data cleaning - [Common Regex Patterns](https://elysiatools.com/en/samples/regex-samples): Commonly used regular expression patterns for validation and matching - [Android String Processing Java Samples](https://elysiatools.com/en/samples/android-string-processing-java): Android Java string processing examples including string split and join, regular expressions, and string replacement ## Related content - [Regex Testing, Visualization, and Pattern Debugging Tools](https://elysiatools.com/en/hubs/regex-utility): Compare regex testers, explainers, cheat sheets, visualizers, linters, performance scanners, and replacement preview tools in one hub for safer pattern design and debugging workflows.