ReDoS and catastrophic backtracking

One trailing character that cannot match turns /^(a+)+$/ into a CPU pin

A dev.to writeup treats regex safety as a measurement problem rather than a blacklist of bad shapes, and the acceptance criterion for a rewrite is the shape of the curve on the same hostile input. The author warns the absolute milliseconds move with hardware and engine version.