Detects ReDoS vulnerabilities in regexes using Thompson NFA construction and spectral radius analysis.
npm install resafe
Lightweight package to detect unsafe regex patterns and prevent ReDoS.
- Pure Mathematical Analysis: Thompson NFA construction with spectral radius computation
- Deterministic Detection: Analyzes automaton structure, not pattern matching heuristics
- Spectral Radius: Detects exponential growth when eigenvalue > 1.0
- Fast Analysis: Average analysis time <1ms per pattern
`` | ` | ` |
Simple pattern check |
` check(/([a-zA-Z0-9]+)*$/); |
Production-safe pattern validation |
` const safeRegex = check("^[0-9]+$", { |
Custom threshold configuration |
` check("a+a+", { |
Regular expressions are powerful but can be a security bottleneck. A single poorly crafted regex can freeze a Node.js/Bun event loop. Resafe helps you:
1. Educate: Developers learn why a regex is bad through the "Solution" hints.
2. Automate: Run checks during CI/CD to catch ReDoS early.
3. Secure: Stop malicious or accidental "Catastrophic Backtracking" patterns.