The following regular expression introduced for validating the hostname is vulnerable to ReDoS:

/^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]).)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9])$/

The slowdown is very serious: for 40 characters around 5 seconds matching time. I would suggest one of the following:

• remove the regex,
• limit the number of characters that can be matched by the repetition,
• limit the input size.

Moreover, the regular expression allows validation bypassing and hence arbitrary command execution!!!

If needed, I can provide an actual example showing the slowdown or the validation bypass.