Service hang via catastrophic URL validation backtracking

Regular expression denial of service in Nescalante urlregex 0.1 through 0.5 allows remote authenticated users to cause a service hang. The exported validator builds a composite URL pattern and executes it with Node.js RegExp, whose authentication and domain alternatives backtrack catastrophically on a long nonmatching URL. Exploitation requires an embedding application to pass attacker-controlled URL text to the validator, consuming its JavaScript execution thread and interrupting dependent service processing.