Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A regular expression can hold up a server when a backtracking engine explores a huge number of possible ways to match an input before rejecting it. A DEV Community post by Serguey Asael describes one email-validation regex that allegedly kept a worker busy for forty seconds; the post does not include the pattern or runtime, so that duration is the author’s account, not an independently reproducible measurement. The underlying risk—regular expression denial of service, or ReDoS—is documented by OWASP and the Node.js documentation.
What happened in the forty-second example?
In the post, an email-address validation pattern contained nested groups and repetition. An input of roughly fifty characters almost matched, then failed on its final character. The author says one worker thread remained busy for forty seconds and that a similar later request consumed a second thread. The post does not provide the expression, code, runtime, server configuration, input, or timing method, so those details cannot be independently checked.
As an Amazon Associate I earn from qualifying purchases.
The useful lesson is not that every email regex is dangerous. It is that a pattern’s apparent brevity says little about its worst-case execution cost. The exact risk depends on the complete expression, the regex engine, and the input.
Why can a failed match take so long?
Many regex engines use backtracking: when a choice made earlier in the pattern leads to a later mismatch, the engine returns to that choice and tries another possibility. Repetition nested inside repetition, or repeated alternatives that overlap, can give the engine many ways to divide the same characters among pattern components.
#1 Best Overall
A near-match that fails late can be especially expensive. The engine may need to explore many allocations before it can establish that none works. OWASP describes ReDoS as a denial-of-service risk in which some regex implementations can take extremely long—potentially exponential—time on particular inputs.
A small example of growing search
OWASP illustrates the problem with a vulnerable pattern and inputs that end in a character the pattern cannot accept. For its example, it counts 16 possible paths for aaaaX and 65,536 for aaaaaaaaaaaaaaaaX. These are illustrative path counts for OWASP’s example, not measurements from the forty-second incident.
Rank #2
Risky shapes include repeated groups that themselves repeat, such as (a+)+$, and repeated alternatives that overlap, such as (a|aa)+$ or (a|a?)+$. These forms are warning signs, not proof that a particular application can be exploited: the full pattern, engine, and reachable inputs matter.
Can a regex block a server?
Yes, if matching runs on a thread responsible for other work and takes a long time. In Node.js, synchronous regex evaluation uses the event loop thread; a CPU-heavy match can delay unrelated callbacks and requests. Node.js documentation warns that vulnerable regexes can cause ReDoS and notes that no regex engine can guarantee linear-time evaluation for every expression.
The operational impact depends on architecture. A busy worker or event loop can reduce the capacity available to serve other work, while repeated costly requests can compound the delay. The post’s account of a second worker being occupied is specific to that author’s scenario; it does not establish how other servers or runtimes would behave.
How to reduce the risk
1. Avoid ambiguous repetition
Review the whole expression for nested repetition and repeated alternatives that can match the same text in multiple ways. Rewrite it to make character allocation unambiguous where possible, and do not assume that a short pattern is automatically cheap.
2. Bound input before matching
Set a reasonable maximum length for untrusted input and reject longer values before running the regex. A length cap does not repair a pathological pattern, but it limits how much input the engine can be asked to process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Use a suitable validator or engine
For common formats such as email addresses, consider a well-tested validator rather than maintaining a complex custom regex. A linear-time regex engine may help when its syntax and feature set fit the task. Check compatibility before switching: available features and guarantees differ, and a different engine is not a drop-in solution for every pattern.
Best Value
4. Apply execution limits where supported
Use a timeout or other execution limit if the target runtime or library provides one. The Node.js and OWASP guidance cited here does not establish a universal timeout API, so verify the mechanism for the specific language and engine instead of assuming a portable setting exists.
5. Test adversarial near-matches
Add long inputs that almost satisfy the expression but fail near the end to regression tests. Run them with the same engine and relevant settings used in production, and observe execution time as input length grows. A pattern that seems fast on ordinary valid examples may behave very differently on a deliberately constructed failure case.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the incident does—and does not—show
The post is a useful illustration of how a late-failing input can expose a costly pattern, but it does not provide enough detail to reproduce the claimed forty-second runtime or attribute it to a particular language, library, or server design. OWASP and Node.js documentation support the general backtracking and event-loop risks; they do not independently verify that specific timing.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThere is no universal fix that makes every regex safe. Review the expression in the context of its engine and inputs, constrain untrusted data, and test the failure cases that could consume the most work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
