The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
https://github.com/advisories/GHSA-x5pg-88wf-qq4p
https://nodesecurity.io/advisories/531