Collected research

A Sense of Time for JavaScript and Node.js: First-Class Timeouts as a Cure for Event Handler Poisoning

James C. Davis, Eric R. Williamson and Dongyoon Lee · usenix.org

Event-driven servers such as Node.js multiplex many clients onto few threads, so a single request that blocks one thread, through an expensive regular expression or a synchronous API call, leaves the whole server unresponsive to everyone. The paper shows such event handler poisoning bugs are common in the Node.js ecosystem and adds first-class timeouts that abort runaway callbacks.

Record

Researcher

James C. Davis, Eric R. Williamson and Dongyoon Lee

Published by

usenix.org

Topic

Server

In the archive

• Collected in the 2018 research round

Related sources

• USENIX Security '18 - A Sense of Time for JavaScript and Node.js

Tags

• dos
• algorithmic-complexity
• nodejs
• javascript-runtime
• defence
• mitigation
• measurement-study
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of James C. Davis, Eric R. Williamson and Dongyoon Lee, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.