Event-loop blocking

What it is

A synchronous call blocks the event loop — readFileSync in a handler, a busy-wait, a synchronous crypto call, or a regular expression prone to catastrophic backtracking.

Why it matters

Nothing else on that instance progresses while it runs, including health checks. A regex that backtracks on a crafted input turns a single request into a denial of service for the whole process.

How to fix it

Use the async variants, and move genuinely blocking work to a worker thread. For regular expressions, avoid nested quantifiers over user input and bound the input length before matching.