JavaScript Regex Cheatsheet: Syntax, Flags and Common Pitfalls

Characters and classes

Anchors and boundaries

Quantifiers

Quantifiers are greedy by default. On the input <b>bold</b>, the pattern <.+> matches the whole string, while the lazy <.+?> matches just <b>.

Groups, backreferences and lookarounds

const re = /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/;
const { year, month } = "2026-10-09".match(re).groups;

"2026-10-09".replace(re, "$<day>/$<month>/$<year>"); // "09/10/2026"

Flags

Practical patterns

A regex can check that an email looks plausible, but no practical pattern validates real addresses. Send a confirmation email instead. Likewise, validate dates with a date library — \d{4}-\d{2}-\d{2} happily accepts 2026-13-45.

Pitfalls that catch everyone

test() with the g flag remembers its position

A regex with g or y stores lastIndex between calls. Reusing it with test() alternates between true and false on the same input:

const re = /a/g;
re.test("a"); // true  (lastIndex is now 1)
re.test("a"); // false (search starts at 1, resets to 0)

Drop the g flag when you only need a yes/no answer, or reset re.lastIndex = 0.

Double escaping in the RegExp constructor

In a string, \ is itself an escape character, so new RegExp("\d+") produces the pattern d+. Write new RegExp("\\d+"), or use a literal /\d+/ when the pattern is fixed. When building a pattern from user input, escape it first with s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").

Catastrophic backtracking

Nested quantifiers such as (a+)+$ or (\w+\s?)*$ can take exponential time on inputs that almost match, freezing a browser tab or a Node.js server (a "ReDoS"). Avoid quantifying a group that itself contains an overlapping quantifier, anchor patterns where you can, and cap input length before matching untrusted text.

matchAll and replaceAll need the g flag

str.matchAll(re) and str.replaceAll(re, …) throw a TypeError if re is a regex without g. Use match/replace for a single match.

FAQ

Does JavaScript support lookbehind?

Yes. Positive (?<=…) and negative (?<!…) lookbehind work in all current browsers and Node.js; Safari added support in version 16.4.

Why doesn't . match a newline?

By default . excludes line terminators. Add the s (dotAll) flag, or use [\s\S] to match any character including newlines.

What is the difference between the u and v flags?

Both enable Unicode-aware matching. v (UnicodeSets) is the newer superset: it adds set subtraction and intersection inside character classes and string properties, and is stricter about escaping in classes.