Regular Expression Denial of Service (ReDoS) in JS & PHP: Spotting Catastrophic Backtracking

Here is a pattern I keep finding in slug and username validators: /^([a-z0-9]+-?)+$/. It looks harmless and passes every unit test. Now send it thirty lowercase letters followed by an underscore. On Node 24, that single test() call ran for about 6.5 seconds on my machine. Node runs your JavaScript on one event-loop thread, so every other request on that process waits for it. A handful of those strings in parallel is a denial of service. I wrote this with help from AI tools and checked every com