Collected research

Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers

Cristian-Alexandru Staicu and Michael Pradel · usenix.org

A study of regular expression denial of service in JavaScript web servers, where the single-threaded event loop means one slow match freezes the whole site. The authors found 25 previously unknown vulnerable regexes in popular Node.js modules, then tested 2,846 popular websites and found 339 of them blockable by a single crafted request.

Record

Researcher

Cristian-Alexandru Staicu and Michael Pradel

Published by

usenix.org

Topic

Server

In the archive

• Collected in the 2018 research round

Related sources

• USENIX Security '18 - Freezing the Web: A Study of ReDoS Vulnerabilities...

Tags

• algorithmic-complexity
• dos
• nodejs
• javascript
• large-scale-scan
• measurement-study
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Cristian-Alexandru Staicu and Michael Pradel, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.