diff --git a/scripts/dev/webdav-handler.mjs b/scripts/dev/webdav-handler.mjs
index 3b0a0893b4..8dfd97b6de 100644
--- a/scripts/dev/webdav-handler.mjs
+++ b/scripts/dev/webdav-handler.mjs
@@ -205,7 +205,7 @@ export function resolveDestinationPath(vaultRoot, destinationHeader) {
 export function verifyBasicAuth(authHeader, expectedUsername, expectedPassword) {
   if (!authHeader || typeof authHeader !== "string") return false;
 
-  const match = /^Basic\s+(.+)$/i.exec(authHeader.trim());
+  const match = /^Basic[ \t]+(\S+)$/i.exec(authHeader.trim()); // linear-time: no overlapping \s+/.+ backtracking (CodeQL js/polynomial-redos #708)
   if (!match) return false;
 
   let decoded;