User-Supplied Regex: How to Run It Without ReDoS
Search filters, alert rules, routing configs and log tools all end up accepting regular expressions from users. In a backtracking engine that is a …
Tag
Denial of Service
Node.js Decompression Bombs: zlib Limits That Work
A 100 KB gzip body can decompress to 100 MB. Node's maxOutputLength stops that in the one-shot zlib functions, but streams silently ignore it, and …