Here is a pattern I keep finding in slug and username validators: /^([a-z0-9]+-?)+$/ . It looks harmless and passes every unit test. Now send it thirty lowercase letters followed by an underscore. On Node 24, that single test() call ran for about 6.5 seconds on my machine. Node runs your JavaScript on one event-loop thread, so every other request on that process waits for it. A handful of those strings in parallel is a denial of service.

I wrote this with help from AI tools and checked every command and claim myself; every timing in this post comes from running the code on Node 24. I build the PixelValut Regex Tester , so I spend a lot of time looking at patterns people paste in from production.…