Regular expressions

What it is and why it exists

A regular expression is a text pattern. It can answer whether a shape occurs, where a match begins, and which substrings belong to individual fields. It can also pass matches to a replacement function. A JavaScript RegExp object holds the pattern, flags, and matching state, while a String method determines how the result is consumed.

Regular expressions fit local text tasks with clear boundaries: extracting fields from a log line, finding several keywords, normalizing a fixed format, or restricting input to a character set. They put character choices, repetition, alternatives, and position constraints into a compact expression, which can map to the text format more directly than a long sequence of index checks.

Compact syntax doesn’t make regex suitable for every parser. URLs, HTML, JSON, and programming languages have dedicated parsers and error models. Rebuilding those grammars in one pattern usually misses escaping, nesting, or normalization rules. Give a regular expression a precise local contract, and give structured formats to APIs that know their full grammar.

You’ll meet regex literals such as /pattern/flags, new RegExp(source, flags), form validation, routing, editor searches, and log-processing code. A literal is clearest when the pattern is fixed. Use the constructor when the pattern contains runtime text, and distinguish “this text is regex syntax” from “this text must match literally.”

JavaScript regular expressions operate on UTF-16 strings. The u and v modes make many operations interpret Unicode code points, but that still isn’t the same as processing user-perceived grapheme clusters, words, or language rules. Internationalized requirements must name the unit before you choose property escapes, Intl.Segmenter, or a specialized parser.

How it works

Patterns, flags, and construction

A regex literal puts the pattern directly in source, as in /invoice-(\d+)/i. The RegExp constructor accepts a string and is useful for runtime fragments. An ordinary string processes backslashes first, so the literal /\d+/ corresponds to new RegExp("\\d+"). String.raw can reduce double escaping in static fragments, but it doesn’t protect interpolated values.

Node 24 supports the following eight flags. Flags belong to the expression object and can’t be added temporarily for one execution. Create another RegExp when you need a different flag set.

The u and v flags can’t be combined. New code can choose v when it needs set intersection, set subtraction, or Unicode properties of strings. The u flag remains direct and common when you need code-point semantics and character properties. If your target environment includes more than Node, verify the browser support range too.

Pattern building blocks

A pattern combines units that consume characters with assertions that only check positions. This table describes common building blocks; it isn’t a recipe whose rows can be joined blindly.

\d means only the ASCII digits 0 through 9, and \w remains centered on ASCII letters, digits, and underscore. For letters or decimal digits across writing systems, explicitly use Unicode properties such as \p{Letter} and \p{Decimal_Number} in u or v mode instead of assuming shorthand classes follow the locale.

Quantifiers are greedy by default, so they prefer to try more repetitions. Adding ? after a quantifier makes it prefer fewer repetitions. Both forms can backtrack when a later unit fails, so “lazy” doesn’t mean “no backtracking” or “always faster.” Choose the form that expresses the boundary you intend to capture.

Leftmost-first matching

Without y, the engine looks for the leftmost position at which a successful match can begin. At one start position, alternation order, greediness, and later constraints determine the final path. If a later unit fails, the engine may return to an earlier choice and try another path. This is ordered, leftmost-first selection, not a search for the longest string among every possible result.

Captures record only the successful path. If an optional branch didn’t participate, its capture is undefined; a repeated capturing group normally retains the text from its final iteration. Use (?:...) when you only need precedence, so the result doesn’t gain numbered slots that are easy to shift accidentally.

Anchors and lookarounds consume no characters, so they can constrain the whole input or its context. ^...$ is common for format validation. Once m is enabled, those anchors may accept line boundaries and no longer mean the entire input. Lookaround is useful for local context constraints, but several nested assertions quickly make a pattern hard to read.

Methods define the result shape

The same pattern returns different data and has different state behavior depending on the method. Choose the method only after deciding whether you need a Boolean, one detailed match, every detailed match, or a transformed string.

The item at index 0 of an exec() result is the full match, followed by numbered captures. groups holds named captures, while index holds the start position. With d, indices uses the same slot structure for [start, end] pairs. These string indices count UTF-16 code units.

The g flag searches forward from lastIndex; y requires a match exactly at that position. On success both update lastIndex to the match end, and on failure both reset it to 0. A plain expression’s exec() doesn’t use lastIndex as its starting position.

Examples

These four examples progress through structured extraction, dynamic literals, contiguous scanning, and Unicode units. Every output below came from running the corresponding file with Node 24.14.0.

Extracting named fields and indices

The log pattern uses m to apply anchors per line, g to collect every result, and d to retrieve the message field’s absolute range. Named captures keep the calling code independent of capture order.

matchAll() preserves every match’s capture details and advances state on an internal copy, so this iteration doesn’t leave linePattern.lastIndex changed. If a message contains a non-BMP character, messageSpan still contains UTF-16 indices and isn’t directly a count of user-perceived characters.

This pattern checks only the shape of a log line; it doesn’t prove that a time exists. If hours and minutes have business ranges, convert the captures to numbers and perform semantic checks afterward. Adding calendar rules to the pattern would make the contract harder to read.

Inserting dynamic literals safely

The keywords are data, not regex syntax. RegExp.escape() turns each term into source text that can be embedded safely in a larger pattern, and alternation then joins those escaped fragments.

const keywords = ['C++', 'node.js', '[draft]'];
const escaped = keywords.map(RegExp.escape);
const keywordPattern = new RegExp(escaped.join('|'), 'gi');
const title = 'Move [draft] C++ addon to Node.js; keep C+ notes.';

console.log(escaped);
console.log(title.match(keywordPattern));

[ '\\x43\\+\\+', '\\x6eode\\.js', '\\[draft\\]' ]
[ '[draft]', 'C++', 'Node.js' ]

The hexadecimal escape for the leading letter is deliberate. It prevents an escaped fragment placed after text such as \1 or \x0 from being parsed as part of the preceding escape. A hand-written function that “adds backslashes to metacharacters” usually doesn’t cover this concatenation context.

RegExp.escape() guarantees only that text is interpreted literally. It doesn’t implement authorization, length limits, or match boundaries. When the keyword array is empty, escaped.join('|') produces an empty pattern that matches at every position, so the caller must define “no keywords” separately.

Scanning contiguously with sticky matching

A lexical scanner requires each new token to follow the preceding token; it mustn’t silently jump over an unknown character. The y flag makes lastIndex a required start position, which fits this contiguous-consumption contract.

const tokenPattern =
  /(?<space>\s+)|(?<number>\d+(?:\.\d+)?)|(?<operator>[()+\-*/])/y;

function tokenize(expression) {
  tokenPattern.lastIndex = 0;
  const tokens = [];

  while (tokenPattern.lastIndex < expression.length) {
    const position = tokenPattern.lastIndex;
    const match = tokenPattern.exec(expression);
    if (!match) throw new SyntaxError(`Unexpected token at ${position}`);
    if (match.groups.space) continue;

    const type = match.groups.number === undefined ? 'operator' : 'number';
    tokens.push(`${type}:${match[0]}@${position}`);
  }

  return tokens;
}

console.log(tokenize('12 + 3.5*(7-2)').join('\n'));
try {
  tokenize('2 + @');
} catch (error) {
  console.log(error.message);
}

number:12@0
operator:+@3
number:3.5@5
operator:*@8
operator:(@9
number:7@10
operator:-@11
number:2@12
operator:)@13
Unexpected token at 4

The code saves position before each exec() because failure resets a sticky expression’s lastIndex to 0. If this used g by mistake, the engine could pass @ and search for another recognized token, allowing the scanner to accept a gap it should reject.

This function only performs lexical tokenization; it doesn’t evaluate the expression. Balanced parentheses, operator placement, precedence, and division by zero belong to later parsing or evaluation. Treating “all text can be tokenized” as “the whole expression is valid” would be a separate contract error.

Separating code units, code points, and graphemes

Unicode properties can describe letters and combining marks across writing systems. At the same time, \w still doesn’t mean every character in a natural-language word, and a Unicode-aware dot advances only one code point.

const label = 'naïve 中文 cafe\u0301 👩‍💻';
const unicodeWords = label.match(/[\p{Letter}\p{Mark}]+/gu);
const asciiWords = label.match(/\w+/g);
const codePoints = '👩‍💻'.match(/./gu);
const graphemes = [
  ...new Intl.Segmenter('en', { granularity: 'grapheme' }).segment('👩‍💻'),
].map(({ segment }) => segment);

console.log(unicodeWords);
console.log(asciiWords);
console.log(codePoints);
console.log(graphemes);

[ 'naïve', '中文', 'café' ]
[ 'na', 've', 'cafe' ]
[ '👩', '‍', '💻' ]
[ '👩‍💻' ]

[\p{Letter}\p{Mark}]+ puts letters and combining marks in one class, so it retains the decomposed e plus accent. Real word segmentation also depends on language, punctuation, and writing system. Use Intl.Segmenter with an appropriate locale when you need user-facing text boundaries.

/./gu treats each emoji surrogate pair as one code point but still splits the zero-width-joiner sequence into three code points. The final line segments grapheme clusters instead, treating the entire profession emoji as one user-perceived character.

Pitfalls

Reusing a stateful expression

Fix: remove g when you don’t need incremental state, or create the expression inside the function. For a deliberate scan, give one owner control of the loop and set lastIndex explicitly at entry. Don’t share a mutable matcher across async operations.

Treating dynamic text as pattern syntax

Fix: compile input directly only when it is explicitly allowed to describe regex syntax. For literal search on Node 24, use RegExp.escape(query), and handle the empty string, maximum length, flags, and outer boundaries separately.

Confusing shape checks with semantic validation

Fix: let regex filter a precisely defined lexical shape, then validate captures with domain APIs or numeric rules. Use URL for URLs, JSON.parse() for JSON, and a parser for HTML. Error messages should identify the layer that actually failed.

Assuming \w, \b, and dot understand human text

Fix: state whether the unit is a UTF-16 code unit, Unicode code point, grapheme cluster, or language word. Use \p{...} with u or v for character properties, and use Intl.Segmenter or a domain library for grapheme and word boundaries.

Forgetting that replacement strings have syntax

Fix: use replacement tokens deliberately when you want capture interpolation. To insert dynamic text verbatim, pass a function such as text.replace(pattern, () => replacement). Test values containing $&, $1, and consecutive dollar signs.

Hiding backtracking risk with lazy quantifiers

Fix: remove repeated structures that can divide the same text in several ways, narrow choices with mutually exclusive character classes and explicit delimiters, and limit untrusted input length. Test long near-miss failures. Use a linear scanner or specialized parser when you can’t constrain the ambiguity clearly.

Further reading

• ECMAScript 2026: RegExp objects
• MDN JavaScript guide: Regular expressions
• MDN: RegExp.escape()
• MDN: unicodeSets property
• OWASP: Regular expression denial of service