> Who knew a regex engine was such a security issue
Anyone who has ever implemented a regex engine, I would imagine. Regex has always been a security nightmare, especially due to persistent attempts to use regexes to validate untrusted input
> especially due to persistent attempts to use regexes to validate untrusted input
This is not the case here, it's an untrusted regex which can be the issue.