Regex Railroad Diagram Visualizer & ReDoS Vulnerability Tester
Why ReDoS (Regular Expression Denial of Service) Crashes Servers
Regular expressions with ambiguous overlapping repeating groups—such as (a+)+$ or ([a-zA-Z]+)*—exhibit Catastrophic Backtracking. When evaluated against non-matching strings, the regex engine explores an exponential number of permutations (\(O(2^N)\)), locking up CPU worker threads at 100% capacity and crashing production Node.js, Python, or Ruby services.
How Railroad Diagrams Improve Regex Readability
Railroad diagrams convert cryptic symbol patterns (quantifiers, capture groups, lookaheads) into intuitive visual flowcharts where characters flow sequentially from left to right along colored rails, instantly clarifying execution order.
Frequently asked questions
How do I fix a ReDoS vulnerability?
Eliminate nested quantifiers. Instead of (a+)+, rewrite the logic using mutually exclusive character classes or atomic groups / possessive quantifiers.
Can client-side regexes cause ReDoS?
Yes! Evil regexes evaluated in client browsers can freeze the entire browser tab UI thread, triggering 'Page Unresponsive' warnings.
Detect regex vulnerabilities, secret leaks, and dependencies before production deployments.