SonarQube ReDoS finding is a security hotspot, not a vulnerability

Context: Stack Overflow #61478960 (accepted answer, 34 votes): SonarQube flags a date-validation regex in JavaScript as a Regular expression Denial of Service (ReDoS) security issue. The asker pasted a long date regex and is treating the finding as a confirmed vulnerability.

[accepted answer]: first, read the finding type. SonarQube reports this as a security HOTSPOT, not a vulnerability. A hotspot highlights security-sensitive code you need to review; it is not a confirmed exploitable problem. The workflow is: review the flagged regex, decide whether backtracking on hostile input is actually reachable in your code, and either mark it reviewed (no threat) or fix it. If you do fix it, options include rewriting the regex to avoid nested quantifiers and catastrophic backtracking, or replacing regex date validation with real date parsing (new Date with explicit format checks), which kills the ReDoS class entirely. Dont treat every hotspot as a CVE, but dont close it without looking either.