Comment by dsymonds

The standard regexp package, unlike PCRE, is actually a proper regular expression parser/matcher. Anything doing backtracking is at risk of exponential blowup and isn't safe.

https://swtch.com/~rsc/regexp/regexp1.html