RegExp.escape()

RegExp.escape(str), added in ECMAScript 2025, returns a copy of str with every character that is syntactically special inside a regular expression pattern (eg. . * + ? ( ) [ ] { } | ^ $ \ /) escaped with a backslash, so the result can be safely spliced into a RegExp pattern and matched purely as literal text.

Before this existed, projects had to ship their own escaping helper (commonly a regex like str.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')) — easy to get subtly wrong, eg. by missing a character introduced by a later RegExp feature. RegExp.escape() is maintained by the engine itself, so it always stays in sync with whatever the pattern grammar currently considers special.

A very common bug: building a regex from user-supplied text without escaping it first, so that characters like '.' or '(' are misinterpreted as regex syntax instead of literal text.
function highlight(text, term) {
  const pattern = new RegExp(RegExp.escape(term), 'gi');
  return text.replace(pattern, m => '[' + m + ']');
}

console.log(highlight('Price: $9.99 (was $12.00)', '$9.99'));
console.log(RegExp.escape('a.b*c'));

Price: [$9.99] (was $12.00) a\.b\*c