regex dos.js

var REGEX = /^((a)+)+$/;
function test(n) {
  var input = Array(n).join('a') + 'b';
  var id = 'n='+n;
  console.log(input);
  console.time(id);
  REGEX.exec(input);
  console.timeEnd(id);
}

for (var i = 1; i < 60; i++) {
  test(i);
}

b
n=1: 0ms
ab
n=2: 0ms
aab
n=3: 0ms
aaab
n=4: 0ms
aaaab
n=5: 0ms
aaaaab
n=6: 0ms
aaaaaab
n=7: 0ms
aaaaaaab
n=8: 0ms
aaaaaaaab
n=9: 0ms
aaaaaaaaab
n=10: 0ms
aaaaaaaaaab
n=11: 0ms
aaaaaaaaaaab
n=12: 0ms
aaaaaaaaaaaab
n=13: 0ms
aaaaaaaaaaaaab
n=14: 0ms
aaaaaaaaaaaaaab
n=15: 0ms
aaaaaaaaaaaaaaab
n=16: 1ms
aaaaaaaaaaaaaaaab
n=17: 2ms
aaaaaaaaaaaaaaaaab
n=18: 2ms
aaaaaaaaaaaaaaaaaab
n=19: 5ms
aaaaaaaaaaaaaaaaaaab
n=20: 11ms
aaaaaaaaaaaaaaaaaaaab
n=21: 22ms
aaaaaaaaaaaaaaaaaaaaab
n=22: 43ms
aaaaaaaaaaaaaaaaaaaaaab
n=23: 89ms
aaaaaaaaaaaaaaaaaaaaaaab
n=24: 173ms
aaaaaaaaaaaaaaaaaaaaaaaab
n=25: 350ms
aaaaaaaaaaaaaaaaaaaaaaaaab
n=26: 699ms
aaaaaaaaaaaaaaaaaaaaaaaaaab
n=27: 1336ms
aaaaaaaaaaaaaaaaaaaaaaaaaaab
n=28: 2601ms
aaaaaaaaaaaaaaaaaaaaaaaaaaaab
n=29: 5203ms
aaaaaaaaaaaaaaaaaaaaaaaaaaaaab
n=30: 10407ms
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaab
n=31: 20820ms
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab

https://nodesecurity.io/advisories/53
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS#Evil_Regexes
https://swtch.com/~rsc/regexp/regexp1.html