How do you regression-test a ReDoS fix without hanging CI?

A known-bad regex is useful evidence, but putting it directly in the test process can hang the runner...