Regular Expressions (Regex) Master Cheat Sheet: Engine Mechanics, Lookarounds & ReDoS Prevention

Regular expressions use meta-characters to define search patterns. Understanding character class shorthand, string boundaries, and word anchors is essential for writing deterministic patterns without unintended matches.

By default, regex quantifiers are **greedy** — they consume as many characters as possible before backtracking to satisfy the rest of the pattern. Appending a `?` makes them **lazy (reluctant)**, consuming as few characters as possible. In PCRE, Java, and modern runtimes, possessive quantifiers (`*+`, `++`) prohibit the engine from ever giving back characters, completely eliminating backtracking overhead. ```javascript // Given the HTML string: // 1. Greedy quantifier (.*) matches the entire span: const greedy = /

Lookarounds match a position without consuming characters or including them in the match result. They are critical for password validation, complex boundary checks, and format transformations. ```javascript // Strong Password Validation using Multiple Positive Lookaheads: // Requirements: At least 8 chars, 1 uppercase, 1 lowercase, 1 number, 1 special symbol const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]).{8,}$/; // Number formatting: Add commas as thousand separators using Lookaheads const formatCurrency = (str) => str.replace(/\B(?=(\d{3})+(?!\d))/g, ','); console.log(formatCurrency('1234567890')); // "1,234,567,890" ```

Parentheses `(...)` create capturing groups by default, forcing the regex engine to allocate memory buffers for backreferences. Use non-capturing groups `(?:...)` when grouping is only needed for logic, and named groups `(?...)` for self-documenting code.

const isoDate = '2026-10-22';
const dateRegex = /^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})$/;
const match = isoDate.match(dateRegex);

if (match) {
  const { year, month, day } = match.groups;
  console.log(`Day: ${day}, Month: ${month}, Year: ${year}`);
}

// Suboptimal (allocates 2 capture groups):
const slow = /(http|https):\/\/([a-z0-9.-]+)/;

// Optimized (allocates only the hostname capture group):
const fast = /(?:https?):\/\/([a-z0-9.-]+)/;

Non-deterministic Finite Automaton (NFA) engines evaluate regular expressions by testing possible paths and backtracking upon failures. When nested ambiguous quantifiers are evaluated against non-matching input strings, the engine's step count explodes exponentially ($O(2^n)$), freezing web servers and causing Denial of Service (ReDoS). **The Vulnerable Pattern Example:** ```text Pattern: ^(a+)+$ Input: aaaaaaaaaaaaaaaaaaaaaaaaa! (25 'a' followed by an exclamation mark) ``` The engine attempts all combinations of partitioning 25 letters across the inner and outer quantifiers ($2^{25} = 33,554,432$ operations), completely blocking the single-threaded Node.js event loop for seconds. **Engineering Hardening Guidelines:** 1. **Never Nest Quantifiers**: Avoid constructs like `(a+)*`, `(.*a)+`, or `([a-zA-Z]+)*`. 2. **Make Choices Mutually Exclusive**: Ensure alternative branches cannot match the same token prefix. 3. **Use Atomic Groups or Possessive Quantifiers**: In PCRE/Java/Go, use `(?>(a+)+)` or `a++` to lock in matches and prevent rewind. 4. **Enforce Execution Timeouts**: Always wrap untrusted regex evaluations in timeouts (e.g. `AbortController` or worker threads in Node.js, `re2` engine in Go/Python).

Standardized, battle-tested regular expressions for common web infrastructure and API payload validation tasks: