I maintain CodeSwap, a developer-tools site with browser-based utilities and technical guides. While reviewing its regular-expression tools, I wanted a repeatable answer to a deceptively simple question:
How can I tell whether a regex is merely slow or capable of pinning a CPU with a tiny hostile input?
The answer was not another list of patterns labeled “safe” or “unsafe.” It was a small audit process: identify ambiguous repetition, construct a failing input, measure growth at several lengths, rewrite the pattern, and measure the same input again.
This article documents that process. The exact timings come from a Node.js 22 test run used for the original CodeSwap guide. Hardware and engine versions change absolute numbers, but the growth curve is the useful signal.
The failure mode: many valid paths, followed by one failure
