Nested quantifiers like (a+)+ are the classic ReDoS trigger, and the practical defense on the server is capping input length before the regex ever runs. For Node services that must accept user supplied patterns, a linear time engine such as RE2 removes catastrophic backtracking entirely, at the cost of lookarounds and backreferences. The v flag's set operations are a nice addition, especially for cleaner Unicode property matching.