For what it's worth, quite a lot of libraries don't use NFA/DFA style regexes and instead use something like PCRE, which aren't not necessarily linear in the wo

For what it's worth, quite a lot of libraries don't use NFA/DFA style regexes and instead use something like PCRE, which aren't not necessarily linear in the worst case. I'd hope that URL pattern matching wouldn't need recursive backtracking or whatever, but probably quite a lot of the time people use libraries with the less performance implementations they're not intending to use those features either, so it probably wouldn't be the first time anyone accidentally make their matching way slower from this if that's what happened here.