Regex performance & safety

Safety before cleverness

Regular expressions are a compact way to describe text, but JavaScript’s normal engine is a backtracking engine. When a pattern leaves too many choices open, one short string can make the engine revisit branch after branch before it can say “no.”

This is the last lesson in the Regular expressions module. It builds on patterns and flags, character classes, greedy and lazy quantifiers, groups and backreferences, and anchors and lookaround. The goal is not to fear regex. The goal is to know when a pattern is safe enough for real input.

You will write and step through a tiny matcher, compare counted growth for two dangerous shapes, build a sticky tokenizer, and decide when a regex should be replaced by APIs such as URL objects, JSON.parse, the DOM tree, and string methods.

A backtracking engine tries a path, and if a later piece fails, it walks back to the most recent choice and tries a different path. Greedy quantifiers create choices because they first take as much as possible, then give characters back when the suffix cannot match.

The experiment below implements a deliberately tiny matcher for the shape (a+)+$. It only understands a run of a characters followed by the end anchor, and it tests from the start of the string. That small scope is useful: the matcher counts every state and then compares the final true-or-false result with the native JavaScript regex.

1function matchNested(input) {2  let steps = 0;3  function repeatFrom(index) {4    steps++;5    if (index === input.length) return true;6    if (input[index] !== "a") return false;7    let end = index;8    while (input[end] === "a") end++;9    for (let stop = end; stop > index; stop--) {10      if (repeatFrom(stop)) return true;11    }12    return false;13  }14  const matched = repeatFrom(0);15  return { matched, steps };16}17 18const input = "aaa!";Run19const result = matchNested(input);20console.log(result.matched);21console.log(result.steps);22console.log(/^(a+)+$/.test(input));

The key line is the loop over stop. For "aaa!", the inner a+ can treat the three letters as aaa, aa then a, a then aa, or three separate chunks. All fail because ! is not the end of the string.

1function matchNested(input) {2  let steps = 0;3  function repeatFrom(index) {4    steps++;5    if (index === input.length) return true;6    if (input[index] !== "a") return false;7    let end = index;8    while (input[end] === "a") end++;9    for (let stop = end; stop > index; stop--) {10      if (repeatFrom(stop)) return true;11    }12    return false;13  }14  const matched = repeatFrom(0);15  return { matched, steps };16}17 18const input = "aaa!";19const result = matchNested(input);20console.log(result.matched);21console.log(result.steps);22console.log(/^(a+)+$/.test(input));

Most ReDoS reviews start by naming the shape. A pattern can be long and safe, or short and dangerous. The risky part is not “regex” by itself; it is ambiguity that grows with input.

1const examples = [2  "nested quantifier: ^(a+)+$",3  "overlap: ^(a|aa)+$",4  "ambiguous neighbors: ^a*a*$",5];6console.log(examples.length);7console.log(examples[0].includes("nested"));

JavaScript does not have possessive quantifiers such as a++ or atomic groups such as (?>...). Some regex flavors use those to prevent backtracking into a piece, but JavaScript cannot. Prefer unambiguous character classes, disjoint alternatives, whole-string anchors when you mean the whole string, and input length limits.

1function acceptsSlug(slug) {2  if (slug.length > 32) return false;3  return /^[a-z]+(?:-[a-z]+)*$/.test(slug);4}5 6console.log(acceptsSlug("regex-performance"));7console.log(acceptsSlug("regex--performance"));8console.log(acceptsSlug("a".repeat(40)));

JavaScript runs user code on a single main thread in the browser and on an event loop in Node. A slow regex is CPU work. While that match is running, it does not yield to clicks, timers, rendering, or other server requests. Review the event loop lesson if you want the scheduling model behind that statement.

• Stack Overflow, July 2016. A malformed post with roughly 20,000 whitespace characters triggered heavy backtracking in a whitespace-trimming regex and the site was down for 34 minutes. The postmortem described the simplified case as \s+$ and noted it was quadratic rather than classic exponential, but it was still enough regex work to take down production. Source: ADTmag’s summary of the StackStatus postmortem.
• Cloudflare, July 2019. A WAF rule deployment included a regex that drove CPU to 100% across HTTP/HTTPS serving cores. Cloudflare reported a 27-minute global outage, 13:42 to 14:09 UTC, with traffic dropping by 82% at peak. Source: Cloudflare’s postmortem.

In the browser, isolate untrusted patterns in a Web Worker so the page can keep responding. A timeout cannot interrupt a regex already running on the main thread, but it can terminate a separate worker.

1const worker = new Worker("regex-worker.js");2const timeout = setTimeout(() => {3  worker.terminate();4  console.log("regex worker stopped");5}, 50);6 7worker.onmessage = (event) => {8  clearTimeout(timeout);9  console.log(event.data.matched);10};11 12worker.postMessage({ pattern: "^(a+)+$", input: "aaaa!" });

Tooling helps before runtime. eslint-plugin-regexp finds regex mistakes, style issues, and optimization hints. safe-regex flags many potentially exponential patterns but documents false positives and false negatives. For Node services, RE2 bindings use a linear-time engine for supported patterns, but backreferences and lookaround are not supported. V8 also documents an experimental non-backtracking engine and fallback flags; do not assume that protection is on by default in ordinary JavaScript.

The g flag and the sticky y flag both use lastIndex. The difference is where the next match may start. A global regex may scan forward from lastIndex. A sticky regex must match exactly at lastIndex or fail.

That exact cursor is perfect for a small lexer. The tokenizer below consumes optional whitespace and then one identifier, number, or equals sign. If the next character is not a token, it fails at that cursor instead of hiding the problem by scanning ahead.

1const token = /\s*([A-Za-z_]\w*|\d+|=)/y;Run2const input = "let count = 3";3const parts = [];4 5while (token.lastIndex < input.length) {6  const before = token.lastIndex;7  const match = token.exec(input);8  if (!match) throw new Error("stuck at " + before);9  parts.push(match[1]);10}11 12console.log(parts.join(" | "));13console.log(token.lastIndex);

1const text = "xxcat";2const global = /cat/g;3global.lastIndex = 1;4const foundGlobal = global.exec(text);5console.log(foundGlobal.index);6console.log(global.lastIndex);7 8const sticky = /cat/y;9sticky.lastIndex = 1;10console.log(sticky.exec(text));11console.log(sticky.lastIndex);

A regex is great for regular text shapes: slugs, simple tokens, a known prefix, or a small capture in a line. It is the wrong first tool when the platform already has a parser that understands the format.

1const doc = new DOMParser().parseFromString(2  "<article><h1>Regex</h1><p>Use a parser.</p></article>",3  "text/html",4);5console.log(doc.querySelector("h1")?.textContent);6console.log(doc.querySelector("p")?.textContent);

1const page = new URL("/search?q=regex", "https://example.com");2console.log(page.searchParams.get("q"));3console.log(JSON.parse('{"safe":true}').safe);4console.log("lesson.regex.md".endsWith(".md"));5console.log(new Intl.DateTimeFormat("en-US", {6  month: "short",7  timeZone: "UTC",8}).format(new Date("2026-09-26T00:00:00Z")));

Email deserves special caution. A giant “perfect email regex” is rarely user-friendly or complete. For most products, keep the client-side check simple, then confirm ownership by sending an email. Dates are similar: use Temporal when available for date math and Intl for display instead of trying to encode calendars and time zones in a pattern.

Common misconceptions

• “Lazy quantifiers are safe.” Lazy quantifiers still backtrack. They just try the shortest choice first.
• “Anchors fix performance.” Anchors reduce where a match can start, but they do not remove ambiguous choices inside the pattern.
• “Short test strings prove a regex is safe.” Dangerous patterns often look fine until a crafted failure string grows by a few characters.
• “Static tools prove safety.” Linters and scanners are useful warnings, but they can miss patterns or flag safe ones. Treat them as one layer.
• “Regex is always faster than string methods.” For simple contains, prefix, suffix, or split work, string methods are clearer and often faster.

Key takeaways

• Backtracking engines can revisit many equivalent choices before a match fails.
• Nested quantifiers, overlapping alternation, and ambiguous neighboring quantifiers are the main danger signs.
• ReDoS blocks real work because regex matching is CPU work on the JavaScript thread or Node event loop.
• Sticky y makes lastIndex an exact lexer cursor; failed global or sticky matches reset it to 0.
• Use parsers and platform APIs for HTML, URLs, JSON, dates, email confirmation, and simple string checks.

That wraps the Regular expressions module. Next comes typed arrays in Binary data & memory, where the focus shifts from text patterns to bytes, buffers, and memory views.