Case Studies

This page collects vulnerabilities found with recheck and projects that use it. If recheck helped you to find a vulnerability or you use it in your project, please tell us in the Reports discussion category. An issue or a pull request that adds an entry to this page is welcome, too.

Vulnerabilities found with recheck

JavaScript

Date	Project	Advisory	Note
2022-01	markdown-it	CVE-2022-21670	Reported by the author of recheck.
2022-01	marked	CVE-2022-21680	Cubic backtracking. Reported by the author of recheck.
2022-01	marked	CVE-2022-21681	Exponential backtracking. Reported by the author of recheck.
2025-11	Valibot	CVE-2025-66020	EMOJI_REGEX. Reported by the author of recheck.
2025-12	three.js	#32622	VTKLoader. Found with recheck by the authors of Revisiting ReDoS Attacks.
2026-02	firebase-admin	#3061	isURL. Found with recheck by the authors of Revisiting ReDoS Attacks.
2026-03	path-to-regexp	CVE-2026-4923	The advisory analyzes the regular expression with recheck and links to the Playground.
2026-09	highlight.js	#4529	17 regular expressions in 15 grammars, found with recheck.

Ruby

ooooooo_q collected the regular expressions that Ruby web applications compile at runtime, translated them into JavaScript syntax, checked them with recheck, and reported the vulnerable ones. The method is described in an article (in Japanese), and the reports led to the following advisories.

Date	Project	Advisory	Note
2022-04	Nokogiri	CVE-2022-24836	HTML encoding detection.
2022-05	Rack	CVE-2022-30122	Multipart parsing.
2022-12	rails-html-sanitizer	CVE-2022-23517
2023-01	Rack	CVE-2022-44570	Range header parsing.
2023-01	Rack	CVE-2022-44571	Content-Disposition parsing.
2023-01	Rack	CVE-2022-44572	Multipart parsing.
2023-01	Rails	CVE-2023-22792	Action Dispatch.
2023-01	Rails	CVE-2023-22796	Active Support underscore.
2023-01	GlobalID	CVE-2023-22799
2023-03	Rack	CVE-2023-27539	Header parsing.
2023-03	Ruby time	CVE-2023-28756
2023-06	Ruby uri	CVE-2023-36617
2024-10	Rails	CVE-2024-47888	Action Text.

Projects using recheck

As of October 2026, eslint-plugin-redos appears in the package.json of more than a hundred public repositories on GitHub.

Testing their own regular expressions

• Zod runs checkSync over every regular expression it ships in its test suite, including the parameterized ones.
• marked has a test:redos script that checks every tokenizer rule with check and prints the vulnerable ones.
• path-to-regexp asserts in its tests that the regular expressions it generates are reported as safe.

Guarding regular expressions built at runtime

• Civitai rejects a pattern in a submitted settings manifest unless check reports it as safe.
• Condo checks the keys of a message template with checkSync before turning them into regular expressions.
• pi-mcp-adapter, an MCP adapter for the Pi coding agent, rejects a regular expression query from the agent unless checkSync reports it as safe.

Linting with eslint-plugin-redos

• core-js enables redos/no-vulnerable as an error over its whole code base, and marks the few regular expressions it disables the rule for as safe in the source.
• markdownlint enables redos/no-vulnerable as an error with a long timeout.
• pjax-api enables it as an error with ignoreErrors: false, so that even an unknown result fails the lint.
• Crosshare enables it in the ESLint configuration of its app and its cloud functions.
• better-auth-harmony turns the recommended configuration on with an environment variable, so that the slower check runs on demand.
• Mailflow keeps a separate audit configuration to run before adding a new text-processing regular expression.
• editorconfig-core-js gets redos/no-vulnerable as an error from the shared configuration @cto.af/eslint-config, which turns it on for every project of its author.

Services and other tools

• devina.io ReDoS Checker is an online checker powered by recheck.
• Gixy-Next, a scanner for nginx configurations, checks the regular expressions in location directives through recheck-http-api. Its author compared ReDoS checkers and found recheck to be the strongest.
• The Datadog static analysis rule typescript-browser-security/regexp-non-literal recommends recheck for checking regular expressions built at runtime.

Tools built on recheck

• recheck-cli scans files for regular expressions and checks them.
• redos-scanner scans a GitHub repository.
• gorecheck is a command-line tool written in Go.
• recheck-http-api exposes recheck as an HTTP endpoint.
• recheck-esm repackaged recheck as ES modules before 4.6.1 shipped them.
• ReDoSDetector is a Burp Suite extension built on recheck-core from Maven Central, and it also works as a standalone GUI and command-line tool.

Talks

The author presented recheck in the following talks (in Japanese).

• ハイブリッド型 ReDoS 検出プログラムの実装 (A Hybrid Approach to Detect ReDoS), the 62nd Programming Symposium, January 2021.
• ReDoS 検出プログラム recheck の開発 (recheck: ReDoS check program), the 63rd Programming Symposium, January 2022.
• ReDoS 検出の最先端 recheck の紹介 (State of the Art of ReDoS Detection), YAPC::Japan::Online 2022, March 2022.