We analyzed sonarQube report and it shows security hotspots for

string.replace(/(\d)(?=(\d{3})+(?!\d))/g, "$1,") regex to put comma after every 3 digits

Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service.

I already searched but didn't found any fix or workaround for it. We are looking for a fix, so it will pass sonarqube.

I also tried toLocaleString() but no luck.