Resource exhaustion, limits and ReDoS

A request that costs the server 400 milliseconds is harmless. A thousand of them in a minute are not, and neither is one text that makes a pattern run for an hour. In this lesson’s model, a regular expression with nested quantifiers needs about 540 million tries on 30 characters, and more than an hour on 40.

OWASP’s A10:2025 says that nothing in information technology should be limitless. This lesson covers resource exhaustion, the limits that prevent it, and ReDoS, a regular expression that takes exponentially longer as its input grows, and it ends with an exercise on hostile input.

Every limit is a decision, and the runtime’s defaults leave several of them undecided

Resource exhaustionresource exhaustion: A condition in which requests use up something the service shares, such as CPU time, memory, connections, disk or a paid quota, so that it slows down or stops for everyone. CWE-770 names the missing limits behind it. happens when requests use up something the service shares: CPU time, memory, connections, disk or a paid quota. A bug, a retry loop or one large customer causes it as easily as an attacker does. CWE-770 names the cause, allocation of resources without limits or throttling.

Limits are numbers fixed before the request arrives: how much of a resource one request, one user or one kind of work may use. They matter most near capacity, where a server slows down fast. Move the arrivals of this single-queue model from 90 to 99 a second:

At 90 arrivals a second the average request takes 100 ms, ten times its 10 ms of service, and at 99 it takes 1,000 ms, a hundred times. A plain Node.js server decides some limits and leaves others to you. This program reads them from a server that is never started, then reads a body of three megabytes with and without a count:

// The limits of a plain Node.js HTTP server, read from a server object that is never started, and what happens to a
// request body when nothing counts it.
import http from 'node:http';
import { Readable } from 'node:stream';

const server = http.createServer();
const limits = [
  ['server.headersTimeout', server.headersTimeout, 'ms to receive all the headers of a request'],
  ['server.requestTimeout', server.requestTimeout, 'ms to receive the whole request'],
  ['server.keepAliveTimeout', server.keepAliveTimeout, 'ms an idle connection is kept for the next request'],
  ['server.timeout', server.timeout, 'ms of socket inactivity (0: never)'],
  ['server.maxRequestsPerSocket', server.maxRequestsPerSocket, 'requests on one connection (0: no limit)'],
  ['http.maxHeaderSize', http.maxHeaderSize, 'bytes of headers'],
];
for (const [name, value, meaning] of limits) console.log(`${name.padEnd(28)} ${String(value).padStart(7)}  ${meaning}`);
console.log('A setting for the size of a request body: none. The server hands your code a stream.\n');

// A body of 3 chunks of 1 MiB arrives. The first handler reads it all; the second counts as it reads.
const MiB = 1024 * 1024;
const body = () => Readable.from([Buffer.alloc(MiB), Buffer.alloc(MiB), Buffer.alloc(MiB)]);

async function readAll(stream) {
  let size = 0;
  for await (const chunk of stream) size += chunk.length;
  return size;
}

async function readUpTo(stream, limit) {
  let size = 0;
  for await (const chunk of stream) {
    size += chunk.length;
    if (size > limit) {
      stream.destroy();
      return { status: 413, bytesRead: size };
    }
  }
  return { status: 200, bytesRead: size };
}

console.log(`Without a limit the handler read ${(await readAll(body())) / MiB} MiB.`);
const stopped = await readUpTo(body(), MiB);
console.log(`With a limit of 1 MiB it answered ${stopped.status} after reading ${stopped.bytesRead / MiB} MiB.`);

server.headersTimeout          60000  ms to receive all the headers of a request
server.requestTimeout         300000  ms to receive the whole request
server.keepAliveTimeout         5000  ms an idle connection is kept for the next request
server.timeout                     0  ms of socket inactivity (0: never)
server.maxRequestsPerSocket        0  requests on one connection (0: no limit)
http.maxHeaderSize             16384  bytes of headers
A setting for the size of a request body: none. The server hands your code a stream.

Without a limit the handler read 3 MiB.
With a limit of 1 MiB it answered 413 after reading 2 MiB.

Four limits have values: 60 s for headers, 300 s for a whole request, 5 s of keep-alive and 16 KiB of headers. The socket timeout and the requests per connection are off, and the body has no setting at all, because the server hands your code a stream. With a count, the 1 MiB limit stopped after 2 MiB, since it counts whole chunks. The rest of this lesson takes the limits one at a time:

• A size limit refuses a body, header or URL above a number of bytes before it is read or parsed.
• A shape limit caps nesting depth, item counts and string lengths in structured input.
• A time limit ends a request or call that takes too long, so nothing is held for ever.
• A concurrency limit caps how many requests of one kind run at once and sheds the rest with a 503.
• A ReDoS defence is a rewrite of the pattern, a cap on the input, a linear-time engine or a deadline in an isolated worker.
• A decompression limit caps the bytes that a compressed input may produce, so that a small upload cannot become a huge one.

Every input has a size, a shape and a time budget Pro: opens with a Pro, Premium or Ultimate pass