I once had to explain this class of security vulnerability to IC5-IC7 senior engineers. 0. There is no universal regex language but many. 1. Perl-like ones (R

I once had to explain this class of security vulnerability to IC5-IC7 senior engineers. 0. There is no universal regex language but many. 1. Perl-like ones (Ruby, Perl, and PCRE1/2) contain additional hidden traps. 2. You must vigorously match untrusted input to assume it to include invalid unicode, control characters, and other oddities. 3. You should replicate frontend and backend validations to ensure they are always exactly consistent and correct, preferably through fuzzing and/or property testing.