RE2JS

RE2JS is a pure JavaScript port of Google’s RE2 regular expression engine, built to guarantee linear-time O(n) matching instead of the exponential worst case that backtracking engines like the native RegExp (and PCRE/Perl/Python engines) can hit. It reaches architectural parity with Go’s regexp package by combining DFA and NFA execution strategies to explore all possible matches in a single pass over the input, which eliminates catastrophic backtracking entirely.

Because it never backtracks, RE2JS is specifically positioned as a defense against Regular Expression Denial of Service (ReDoS) attacks — a real risk any time a regex pattern or its input can come from an untrusted source (user-supplied search filters, validation rules, etc.). It ships as a dependency-free, tree-shakeable package that runs identically in Node.js and the browser, with an API modeled closely on Java’s java.util.regex naming conventions from the original RE2 implementation lineage.

What You Get

• A drop-in-style RE2JS matcher API for compiling and executing patterns with linear-time guarantees
• Full architectural parity with Go’s regexp package and Google’s RE2 syntax
• Protection against catastrophic backtracking / ReDoS when matching untrusted patterns or input
• Works identically in Node.js and browser environments with no runtime dependencies
• Compiled build outputs for ESM, CJS, and UMD consumption

Common Use Cases

• Validating or filtering user-supplied input where the regex pattern itself may be attacker-controlled
• Search/filter features that accept end-user regular expressions safely
• Replacing native RegExp in security-sensitive parsing paths (WAFs, log processors, form validators)
• Porting Go-style regex behavior/syntax into a JavaScript codebase

Under The Hood

Architecture - The engine is organized as a classic compiler pipeline under src/: Parser.js builds an AST (Regexp.js) from pattern syntax, Compiler.js lowers it to an instruction program (Prog.js/Inst.js), and execution is handled by two interchangeable backends — Machine.js (NFA simulation) and DFA.js (deterministic automaton), with OnePass.js as a fast-path optimization and Backtracker.js retained for small patterns where backtracking is provably safe. Matcher.js and RE2.js expose the public matching API, Prefilter.js does cheap pre-filtering before full matching, and Unicode.js/UnicodeTables.js handle Unicode character class support.

Tech Stack - Pure JavaScript (ESM-first, type: module), zero runtime dependencies, built with Rolldown (rolldown.config.js) into ESM/CJS/UMD bundles with TypeScript type declarations, tested with Vitest, linted with ESLint, and gated by lefthook pre-commit hooks and a CI-driven test/build/publish pipeline.

Code Quality - src/__tests__/ contains 32 test files covering the parser, compiler, matcher, and Unicode handling, exercising the engine against the same edge cases RE2’s Go implementation targets. Code is organized one class per file with names mirroring the Go/Java RE2 lineage (RE2Flags, PublicFlags, CharClass), which keeps the port easy to cross-reference against upstream RE2 behavior.

API Design - Installation is a single npm install re2js, and the API surface intentionally echoes java.util.regex/RE2 conventions (RE2JS.compile(pattern).matcher(input)), which lowers the learning curve for anyone coming from Go, Java, or RE2-family engines, at the cost of feeling slightly less idiomatic than JavaScript’s native RegExp for JS-only developers.