The web server doesn't matter since it isn't processing the regex. It's the application server that is being tied up. If you're using a multi-threaded applicati

The web server doesn't matter since it isn't processing the regex. It's the application server that is being tied up. If you're using a multi-threaded application server, it would eventually get bogged down. See https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS https://www.owasp.org/index.php/Regular_expression_Denial_of... linked from the original article.