{
  "id": 18627561,
  "title": "A 31-character name froze this Node server for 6 seconds",
  "url": "https://urgent.news/2026/11/07/a-31-character-name-froze-this-node-server-for-6-seconds",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T03:30:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/haiduc0147/a-31-character-name-froze-this-node-server-for-6-seconds-1g39"
  },
  "original_language": "en",
  "account": "The issue at hand involves a Node server freezing for six seconds due to a 31-character display name. The server uses a regular expression to validate the name, which fails to match the excessively long input. This results in the server being unable to answer any other requests during the freezing period.\n\nThe regular expression in question is `/^ (\\w + \\s?) *$/`, which allows for one or more words, each with an optional space after it. The issue arises from the optional space, which allows for multiple ways to match the same text. When the input ends with an exclamation mark, the regular expression fails every time, causing the engine to backtrack through every possible split of the input.\n\nThis backtracking leads to an exponential increase in the time it takes to check the input, resulting in a freezing of the server. The problem is not unique to JavaScript; similar issues can occur in other languages with their respective regex engines. The solution is to modify the regular expression so that each character can only be matched one way, preventing the backtracking issue.\n\nIn summary, a 31-character display name can freeze a Node server for six seconds due to a regular expression that allows for multiple ways to match the same text. This leads to catastrophic backtracking, causing the server to become unresponsive. The solution is to modify the regular expression to prevent the backtracking issue.",
  "summary": "Here's a signup check. A display name is words with single spaces between them. const NAME_RE = /^ (\\w + \\s?) *$/ ; \"Ada Lovelace\" passes. \"Linus\" passes. Each request takes about 3 ms. Then someone signs up as aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa! . That's 30 a's and an exclamation mark. The server takes 5.7 seconds to say \"invalid name\". And for those 5.7 seconds, it doesn't answer anyone else. The…",
  "key_points": [
    "Node server freezes for 6 seconds",
    "31-character display name causes issue",
    "Regular expression leads to backtracking"
  ],
  "editors_take": "Inefficient regular expression patterns transform simple user inputs into denial-of-service vulnerabilities by forcing engines into exponential backtracking that halts entire server processes.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}