Regolith – Regex library that prevents ReDoS CVEs in TypeScript
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like Rust have built-in protection but languages like JavaScript, TypeScript, and Python do not. This library attempts to mitigate these vulnerabilities for TypeScript and JavaScript. How: Regolith uses Rust's Regex library under the hood to prevent ReDoS attacks. The Rust Regex library…
Regolith – Regex library that prevents ReDoS CVEs in TypeScript launched on August 27, 2025 with 27 votes, #571 of 8,530 launches that month and more than 90% of that year's launches. The site was still online in September 2026, 1 year on.
In plain words
Regolith is a regex library for TypeScript and JavaScript that prevents Regular Expression Denial of Service attacks by using Rust's linear-time regex engine under the hood. It addresses a security gap where TypeScript libraries are vulnerable to ReDoS CVEs, unlike languages with built-in protection like Rust. The library guarantees linear-time regex execution, preventing malicious inputs from causing performance degradation through overlapping pattern matching configurations.
written from the facts on this page · September 2026
From the sources
A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case. - JakeRoggenbuck/regolith
In the maker’s words, at launch
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like…
Does a similar job
all alternatives →
- AMA minimal TS library that generates prompt injection attacks2025 · prompt-injector.blueprintlab.io · ▲33
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
Cronexpr, a Rust library to parse and iter crontab expression2024 · docs.rs · ▲160`cronexpr` is a library to parse and drive the crontab expression.
Crust – A CLI framework for TypeScript and BunMar 2026 · github.com · ▲95We've been building Crust (https://crustjs.com/), a TypeScript-first, Bun-native CLI framework with zero dependencies. It's been powering our core product internally for a while, and we're now open-sourcing it. The problem we kept running into: existing CLI frameworks in the JS ecosystem are either minimal arg parsers where you wire everything yourself, or heavyweight frameworks with large dependency trees and Node-era assumptions. We wanted something in between. What Crust does differently: - Full type inference from definitions — args and flags are inferred automatically. No…
Shelgon: A Framework for Building Interactive REPL Shells in Rust2025 · github.com · ▲130I've been working on Shelgon, a framework that lets you build your own custom REPL shells and interactive CLI applications in Rust. You can use Shelgon to: - Create a custom shell with only a few lines of code - Build interactive debugging tools with persistent state between commands - Develop domain-specific language interpreters with shell-like interfaces - Add REPL capabilities to existing applications Getting started is straightforward - implement a single trait that handles your command execution logic, and Shelgon takes care of the terminal UI, input handling, and async runtime…
Robust LLM extractor for websites in TypeScriptMar 2026 · github.com · ▲72We've been building data pipelines that scrape websites and extract structured data for a while now. If you've done this, you know the drill: you write CSS selectors, the site changes its layout, everything breaks at 2am, and you spend your morning rewriting parsers. LLMs seemed like the obvious fix — just throw the HTML at GPT and ask for JSON. Except in practice, it's more painful than that: - Raw HTML is full of nav bars, footers, and tracking junk that eats your token budget. A typical product page is 80% noise. - LLMs return malformed JSON more often than you'd expect, especially with…
More dev tools this month
the category →
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 1d ago · github.com
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 22d ago · talanoa.email
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, August 2025
the whole month →
I built the world's most impractical 1000-pixel display and anyone in the world can draw on it. It draws a single pixel at a time and takes 30-60 minutes to complete a single image. Anyone can participate in the project by voting for the next image to be drawn, and submitting images. https://kilopx.com/
Work · 2025 · benholmen.com
Kitten TTS is an open-source series of tiny and expressive text-to-speech models for on-device applications. We are excited to launch a preview of our smallest model, which is less than 25 MB. This model has 15M parameters. This release supports English text-to-speech applications in eight voices: four male and four female. The model is quantized to int8 + fp16, and it uses onnx for runtime. The model is designed to run literally anywhere eg. raspberry pi, low-end smartphones, wearables, browsers etc. No GPU required! We're releasing this to give early users a sense of the latency and voices…
AI · 2025 · github.com
I was wondering how I can arrange objects along a spherical helix path, and read some articles on it. I ended up learning about parametric equations again, and make this visualization to document what I learned: https://visualrambling.space/moving-objects-in-3d/ feel free to visit and let me know what you think!
Life & fun · 2025 · visualrambling.space
For HTML Day 2025 [1], I made a web service that displays the current sky at your approximate location as a CSS gradient. Colours are simulated on-demand using atmospheric absorption and scattering coefficients. Updates every minute, without the use of client-side JavaScript. Source code and additional information is available on GitHub: https://github.com/dnlzro/horizon [1] https://html.energy/html-day/2025/index.html
Dev tools · 2025 · sky.dlazaro.ca