Service interruption via backtracking route regular expressions

Regular expression denial of service in PillarJS path-to-regexp allows remote attackers to block the event loop via crafted paths. For route patterns with two parameters in one segment separated by a character other than a period, the library emits overlapping lazy capture groups that backtrack excessively on a long nonmatching path. Exposure requires a consuming application to use such a route pattern and pass attacker-controlled path input; successful requests consume the single JavaScript thread and interrupt service without reported data access or modification.