Catastrophic Regex Backtracking: Measured Timing Curve Shows Exponential Slowdown

A developer measured how a nested-quantifier regex, ^(a+)+$, slows down as input grows, using Node 22 and a high-resolution timer. On a failing input, the vulnerable pattern climbed from 46ms at 20 characters to about 31.6 seconds at 32 characters, and at 34 characters it had not returned within two minutes. A rewritten pattern, ^a+$, matched the same strings and stayed under 0.2ms at every length tested. The slowdown comes from the engine trying a roughly exponential number of ways to group characters before concluding that no match exists. The author notes that testing only with strings that match can hide the problem, since failing inputs trigger the worst behavior.