How One Bad Regex Took Down Half the Internet (The Cloudflare Outage)
⏱️ CHAPTER 1: The Day the Web Went Dark
"On July 2, 2019, large sections of the internet simply vanished.
Discord stopped routing messages. Shopify storefronts went dark. Millions of websites returned a terrifying '502 Bad Gateway' error.
Was it a massive DDoS attack? A global undersea cable cut? No. The company responsible for protecting 20% of the entire internet’s traffic—Cloudflare—had accidentally nuked its own CPU cores worldwide.
And the weapon of mass destruction? A single, poorly written Regular Expression.
Welcome back to Behind the Abstraction. Today, we are diving into one of the most dangerous, hidden traps in software engineering: Catastrophic Backtracking and the terrifying reality of ReDoS—Regular Expression Denial of Service."
⏱️ CHAPTER 2: The Magic and Danger of Regex
"Regular Expressions, or Regex, are the duct tape of the internet. We use them everywhere: validating emails, parsing logs, and filtering malicious traffic.
Under the hood, a Regex engine works like a maze solver. It reads your string character by character, trying to find a path that matches your pattern. When it hits a dead end, it steps back and tries another route. This process is called Backtracking.
Most of the time, this takes microseconds. But what happens if you write a pattern that allows for overlapping matches, and then feed it a string that almost matches, but fails at the very last character?"
⏱️ CHAPTER 3: Catastrophic Backtracking Explained
"Let’s look at a deadly piece of code: ^(a+)+$.
This simply means: match one or more 'a's, one or more times.
If we give it a valid string like aaaaa, it passes instantly.
But watch what happens if we give it 20 'a's followed by an 'X': aaaaaaaaaaaaaaaaaaaaX.
The engine reads the 20 'a's and thinks it has a match! But then it hits the 'X'. It realizes it failed, so it backtracks. It tries grouping the 'a's differently: maybe two groups of 10? No, that fails at 'X' too. Maybe four groups of 5? No.
Because of the nested plus signs, the number of combinations the CPU has to check isn't linear—it’s exponential.
For just 20 characters, the engine has to evaluate over 1 million paths. For 30 characters, it's 1 billion paths.
Your CPU spikes to 100%. The thread locks up. Your server freezes. This is Catastrophic Backtracking."
⏱️ CHAPTER 4: The Cloudflare Incident
"Now, let's go back to Cloudflare in 2019.
Cloudflare deployed a new rule to their Web Application Firewall to block malicious JavaScript attacks. Embedded deep inside that rule was a regex that contained overlapping capture groups, very similar to our (a+)+ example.
As soon as this rule was pushed globally, a normal user submitted a HTTP request with a payload that triggered the catastrophic backtracking scenario.
Instantly, the CPU on that single server spiked to 100%. But Cloudflare operates on a massive global network. As traffic was re-routed away from the dead server, the malicious payload hit the next server, killing it too.
In a matter of minutes, CPU usage across Cloudflare’s entire global edge network hit 100%. The internet’s biggest shield had just DDoS’d itself."
⏱️ CHAPTER 5: How to Protect Your APIs
"So, how do Senior Engineers prevent a random user from destroying their API with a ReDoS attack?
Never trust user input in a Regex: If a user can control the string being evaluated, you are vulnerable.
Use Linear-Time Regex Engines: Languages like Go and Rust use the RE2 engine, which drops backtracking entirely. It guarantees linear execution time—$O(N)$—meaning catastrophic backtracking is mathematically impossible.
Set Execution Timeouts: In Node.js or Python, never let a regex run forever. Wrap heavy validations in worker threads or strict timeouts.
Cloudflare fixed their outage by rewriting their Web Application Firewall to use the RE2 engine, ensuring an event like this could never happen again."
⏱️ CHAPTER 6: Summary
"Regular expressions are incredibly powerful, but writing a bad one is like leaving a ticking time bomb inside your server's CPU.
If you want to be a resilient developer, you must understand how the tools underneath your code actually execute.
If you enjoyed this deep dive into system architecture and ReDoS, hit that Like button and subscribe! Have you ever accidentally written an infinite loop or a freezing Regex? Let me know in the comments below.
Thanks for watching, and happy coding!"
#webzonetechtips
#webzonezidane
