diff --git a/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md b/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md
new file mode 100644
index 000000000000..03d3d4cfedaa
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The C++ regular-expression parser has been aligned to the ECMAScript grammar used by `std::regex`.
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 5f4b92a191fc..775e8c717291 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -10,6 +10,7 @@ dependencies:
   codeql/mad: ${workspace}
   codeql/quantum: ${workspace}
   codeql/rangeanalysis: ${workspace}
+  codeql/regex: ${workspace}
   codeql/ssa: ${workspace}
   codeql/typeflow: ${workspace}
   codeql/tutorial: ${workspace}
diff --git a/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll b/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll
new file mode 100644
index 000000000000..7097025c6cb6
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll
@@ -0,0 +1,1200 @@
+/**
+ * Provides a class hierarchy corresponding to a parse tree of C++ regular expressions.
+ */
+
+private import internal.ParseRegExp
+private import codeql.util.Numbers
+private import semmle.code.cpp.exprs.Literal
+private import codeql.regex.RegexTreeView
+// exporting as RegexTreeView, and in the top-level scope.
+import Impl as RegexTreeView
+import Impl
+
+/** Gets the parse tree resulting from parsing `re`, if such has been constructed. */
+RegExpTerm getParsedRegExp(StringLiteral re) {
+  result.getRegExp() = re and result.isRootTerm()
+}
+
+/**
+ * An element containing a regular expression term, that is, either
+ * a string literal (parsed as a regular expression)
+ * or another regular expression term.
+ *
+ * For sequences and alternations, we require at least one child.
+ * Otherwise, we wish to represent the term differently.
+ * This avoids multiple representations of the same term.
+ */
+private newtype TRegExpParent =
+  /** A string literal used as a regular expression */
+  TRegExpLiteral(RegExp re) or
+  /** A quantified term */
+  TRegExpQuantifier(RegExp re, int start, int end) { re.qualifiedItem(start, end, _, _) } or
+  /** A sequence term */
+  TRegExpSequence(RegExp re, int start, int end) { re.sequence(start, end) } or
+  /** An alternation term */
+  TRegExpAlt(RegExp re, int start, int end) { re.alternation(start, end) } or
+  /** A character class term */
+  TRegExpCharacterClass(RegExp re, int start, int end) { re.charSet(start, end) } or
+  /** A character range term */
+  TRegExpCharacterRange(RegExp re, int start, int end) { re.charRange(_, start, _, _, end) } or
+  /** A group term */
+  TRegExpGroup(RegExp re, int start, int end) { re.group(start, end) } or
+  /** A special character */
+  TRegExpSpecialChar(RegExp re, int start, int end) { re.specialCharacter(start, end, _) } or
+  /** A normal character */
+  TRegExpNormalChar(RegExp re, int start, int end) {
+    re.normalCharacterSequence(start, end)
+    or
+    re.escapedCharacter(start, end) and
+    not re.specialCharacter(start, end, _)
+  } or
+  /** A back reference */
+  TRegExpBackRef(RegExp re, int start, int end) { re.backreference(start, end) } or
+  /** A POSIX collating symbol */
+  TRegExpPosixCollatingSymbol(RegExp re, int start, int end) {
+    re.posixStyleCollatingSymbol(start, end, _)
+  } or
+  /** A POSIX equivalence class */
+  TRegExpPosixEquivalenceClass(RegExp re, int start, int end) {
+    re.posixStyleEquivalenceClass(start, end, _)
+  }
+
+/** An implementation that satisfies the RegexTreeView signature. */
+private module Impl implements RegexTreeViewSig {
+  /**
+   * An element containing a regular expression term, that is, either
+   * a string literal (parsed as a regular expression)
+   * or another regular expression term.
+   */
+  class RegExpParent extends TRegExpParent {
+    /** Gets a textual representation of this element. */
+    string toString() { result = "RegExpParent" }
+
+    /** Gets the `i`th child term. */
+    RegExpTerm getChild(int i) { none() }
+
+    /** Gets a child term . */
+    final RegExpTerm getAChild() { result = this.getChild(_) }
+
+    /** Gets the number of child terms. */
+    int getNumChild() { result = count(this.getAChild()) }
+
+    /** Gets the last child term of this element. */
+    RegExpTerm getLastChild() { result = this.getChild(this.getNumChild() - 1) }
+
+    /**
+     * Gets the name of a primary CodeQL class to which this regular
+     * expression term belongs.
+     */
+    string getAPrimaryQlClass() { result = "RegExpParent" }
+
+    /**
+     * Gets a comma-separated list of the names of the primary CodeQL classes to
+     * which this regular expression term belongs.
+     */
+    final string getPrimaryQlClasses() { result = concat(this.getAPrimaryQlClass(), ",") }
+  }
+
+  /** A string literal used as a regular expression */
+  class RegExpLiteral extends TRegExpLiteral, RegExpParent {
+    RegExp re;
+
+    RegExpLiteral() { this = TRegExpLiteral(re) }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and result.getRegExp() = re and result.isRootTerm()
+    }
+
+    /** Holds if dot, `.`, matches all characters, including newlines. */
+    predicate isDotAll() { re.isDotAll() }
+
+    /** Holds if this regex matching is case-insensitive for this regex. */
+    predicate isIgnoreCase() { re.isIgnoreCase() }
+
+    /** Get a string representing all modes for this regex. */
+    string getFlags() { result = re.getFlags() }
+
+    /** Gets the primary QL class for this regex. */
+    override string getAPrimaryQlClass() { result = "RegExpLiteral" }
+  }
+
+  /**
+   * A regular expression term, that is, a syntactic part of a regular expression.
+   */
+  class RegExpTerm extends RegExpParent {
+    RegExp re;
+    int start;
+    int end;
+
+    RegExpTerm() {
+      this = TRegExpAlt(re, start, end)
+      or
+      this = TRegExpBackRef(re, start, end)
+      or
+      this = TRegExpCharacterClass(re, start, end)
+      or
+      this = TRegExpCharacterRange(re, start, end)
+      or
+      this = TRegExpNormalChar(re, start, end)
+      or
+      this = TRegExpGroup(re, start, end)
+      or
+      this = TRegExpQuantifier(re, start, end)
+      or
+      this = TRegExpSequence(re, start, end) and
+      exists(seqChild(re, start, end, 1)) // if a sequence does not have more than one element, it should be treated as that element instead.
+      or
+      this = TRegExpSpecialChar(re, start, end)
+      or
+      this = TRegExpPosixCollatingSymbol(re, start, end)
+      or
+      this = TRegExpPosixEquivalenceClass(re, start, end)
+    }
+
+    /**
+     * Gets the outermost term of this regular expression.
+     */
+    RegExpTerm getRootTerm() {
+      this.isRootTerm() and result = this
+      or
+      result = this.getParent().(RegExpTerm).getRootTerm()
+    }
+
+    /**
+     * Holds if this term is part of a string literal
+     * that is interpreted as a regular expression.
+     */
+    predicate isUsedAsRegExp() { any() }
+
+    /**
+     * Holds if this is the root term of a regular expression.
+     */
+    predicate isRootTerm() { start = 0 and end = re.getText().length() }
+
+    override RegExpTerm getChild(int i) {
+      result = this.(RegExpAlt).getChild(i)
+      or
+      result = this.(RegExpBackRef).getChild(i)
+      or
+      result = this.(RegExpCharacterClass).getChild(i)
+      or
+      result = this.(RegExpCharacterRange).getChild(i)
+      or
+      result = this.(RegExpNormalChar).getChild(i)
+      or
+      result = this.(RegExpGroup).getChild(i)
+      or
+      result = this.(RegExpQuantifier).getChild(i)
+      or
+      result = this.(RegExpSequence).getChild(i)
+      or
+      result = this.(RegExpSpecialChar).getChild(i)
+      or
+      result = this.(RegExpPosixCollatingSymbol).getChild(i)
+      or
+      result = this.(RegExpPosixEquivalenceClass).getChild(i)
+    }
+
+    /**
+     * Gets the parent term of this regular expression term, or the
+     * regular expression literal if this is the root term.
+     */
+    RegExpParent getParent() { result.getAChild() = this }
+
+    /** Gets the associated `RegExp`. */
+    RegExp getRegExp() { result = re }
+
+    /** Gets the offset at which this term starts. */
+    int getStart() { result = start }
+
+    /** Gets the offset at which this term ends. */
+    int getEnd() { result = end }
+
+    override string toString() { result = re.getText().substring(start, end) }
+
+    /**
+     * Gets the location of the surrounding regex, as locations inside the regex do not exist.
+     * To get location information corresponding to the term inside the regex,
+     * use `hasLocationInfo`.
+     */
+    Location getLocation() { result = re.getLocation() }
+
+    /** Holds if this term is found at the specified location offsets. */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      exists(int re_start, int contentStartOffset, string valueText |
+        re.getLocation().hasLocationInfo(filepath, startline, re_start, endline, _) and
+        valueText = re.getValueText() and
+        (
+          valueText.regexpMatch("^\\s*(u8|L|u|U)?R\".*") and
+          exists(string prefix, string delimiter |
+            prefix = valueText.regexpCapture("^\\s*(u8|L|u|U)?R\"", 1) and
+            delimiter = valueText.regexpCapture("^\\s*(u8|L|u|U)?R\"([^()]*)\\(", 2) and
+            contentStartOffset = prefix.length() + delimiter.length() + 3
+          )
+          or
+          valueText.regexpMatch("^\\s*(u8|L|u|U)?\".*") and
+          exists(string prefix |
+            prefix = valueText.regexpCapture("^\\s*(u8|L|u|U)?\"", 1) and
+            contentStartOffset = prefix.length() + 1
+          )
+        ) and
+        startcolumn = re_start + contentStartOffset + start and
+        endcolumn = re_start + contentStartOffset + end - 1
+      )
+    }
+
+    /** Gets the file in which this term is found. */
+    File getFile() { result = this.getLocation().getFile() }
+
+    /** Gets the raw source text of this term. */
+    string getRawValue() { result = this.toString() }
+
+    /** Gets the string literal in which this term is found. */
+    RegExpLiteral getLiteral() { result = TRegExpLiteral(re) }
+
+    /** Gets the regular expression term that is matched (textually) before this one, if any. */
+    RegExpTerm getPredecessor() {
+      exists(RegExpTerm parent | parent = this.getParent() |
+        result = parent.(RegExpSequence).previousElement(this)
+        or
+        not exists(parent.(RegExpSequence).previousElement(this)) and
+        not parent instanceof RegExpSubPattern and
+        result = parent.getPredecessor()
+      )
+    }
+
+    /** Gets the regular expression term that is matched (textually) after this one, if any. */
+    RegExpTerm getSuccessor() {
+      exists(RegExpTerm parent | parent = this.getParent() |
+        result = parent.(RegExpSequence).nextElement(this)
+        or
+        not exists(parent.(RegExpSequence).nextElement(this)) and
+        not parent instanceof RegExpSubPattern and
+        result = parent.getSuccessor()
+      )
+    }
+
+    /**
+     * Gets the single string this regular-expression term matches.
+     *
+     * This predicate is only defined for (sequences/groups of) constant regular
+     * expressions.  In particular, terms involving zero-width assertions like `^`
+     * or `\b` are not considered to have a constant value.
+     *
+     * Note that this predicate does not take flags of the enclosing
+     * regular-expression literal into account.
+     */
+    string getConstantValue() { none() }
+
+    /**
+     * Gets a string that is matched by this regular-expression term.
+     */
+    string getAMatchedString() { result = this.getConstantValue() }
+
+    /** Gets the primary QL class for this term. */
+    override string getAPrimaryQlClass() { result = "RegExpTerm" }
+
+    /** Holds if this regular expression term can match the empty string. */
+    predicate isNullable() { none() }
+  }
+
+  /**
+   * A quantified regular expression term.
+   *
+   * Example:
+   *
+   * ```
+   * ((ECMA|Java)[sS]cript)*
+   * ```
+   */
+  class RegExpQuantifier extends RegExpTerm, TRegExpQuantifier {
+    int part_end;
+    boolean may_repeat_forever;
+
+    RegExpQuantifier() {
+      this = TRegExpQuantifier(re, start, end) and
+      re.qualifiedPart(start, part_end, end, _, may_repeat_forever)
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      result.getEnd() = part_end
+    }
+
+    /** Hodls if this term may match an unlimited number of times. */
+    predicate mayRepeatForever() { may_repeat_forever = true }
+
+    /** Gets the qualifier for this term. That is e.g "?" for "a?". */
+    string getQualifier() { result = re.getText().substring(part_end, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpQuantifier" }
+  }
+
+  /**
+   * A regular expression term that permits unlimited repetitions.
+   */
+  class InfiniteRepetitionQuantifier extends RegExpQuantifier {
+    InfiniteRepetitionQuantifier() { this.mayRepeatForever() }
+
+    override string getAPrimaryQlClass() { result = "InfiniteRepetitionQuantifier" }
+  }
+
+  /**
+   * A star-quantified term.
+   *
+   * Example:
+   *
+   * ```
+   * \w*
+   * ```
+   */
+  class RegExpStar extends InfiniteRepetitionQuantifier {
+    RegExpStar() { this.getQualifier().charAt(0) = "*" }
+
+    override string getAPrimaryQlClass() { result = "RegExpStar" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A plus-quantified term.
+   *
+   * Example:
+   *
+   * ```
+   * \w+
+   * ```
+   */
+  class RegExpPlus extends InfiniteRepetitionQuantifier {
+    RegExpPlus() { this.getQualifier().charAt(0) = "+" }
+
+    override string getAPrimaryQlClass() { result = "RegExpPlus" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * An optional term.
+   *
+   * Example:
+   *
+   * ```
+   * ;?
+   * ```
+   */
+  class RegExpOpt extends RegExpQuantifier {
+    RegExpOpt() { this.getQualifier().charAt(0) = "?" }
+
+    override string getAPrimaryQlClass() { result = "RegExpOpt" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A range-quantified term
+   *
+   * Examples:
+   *
+   * ```
+   * \w{2,4}
+   * \w{2,}
+   * \w{2}
+   * ```
+   */
+  class RegExpRange extends RegExpQuantifier {
+    string upper;
+    string lower;
+
+    RegExpRange() { re.multiples(part_end, end, lower, upper) }
+
+    override string getAPrimaryQlClass() { result = "RegExpRange" }
+
+    /** Gets the string defining the upper bound of this range, if any. */
+    string getUpper() { result = upper }
+
+    /** Gets the string defining the lower bound of this range, if any. */
+    string getLower() { result = lower }
+
+    /**
+     * Gets the upper bound of the range, if any.
+     *
+     * If there is no upper bound, any number of repetitions is allowed.
+     * For a term of the form `r{lo}`, both the lower and the upper bound
+     * are `lo`.
+     */
+    int getUpperBound() { result = this.getUpper().toInt() }
+
+    /** Gets the lower bound of the range. */
+    int getLowerBound() { result = this.getLower().toInt() }
+
+    override predicate isNullable() { this.getAChild().isNullable() or this.getLowerBound() = 0 }
+  }
+
+  /**
+   * A sequence term.
+   *
+   * Example:
+   *
+   * ```
+   * (ECMA|Java)Script
+   * ```
+   *
+   * This is a sequence with the elements `(ECMA|Java)` and `Script`.
+   */
+  class RegExpSequence extends RegExpTerm, TRegExpSequence {
+    RegExpSequence() {
+      this = TRegExpSequence(re, start, end) and
+      exists(seqChild(re, start, end, 1)) // if a sequence does not have more than one element, it should be treated as that element instead.
+    }
+
+    override RegExpTerm getChild(int i) { result = seqChild(re, start, end, i) }
+
+    /** Gets the element preceding `element` in this sequence. */
+    RegExpTerm previousElement(RegExpTerm element) { element = this.nextElement(result) }
+
+    /** Gets the element following `element` in this sequence. */
+    RegExpTerm nextElement(RegExpTerm element) {
+      exists(int i |
+        element = this.getChild(i) and
+        result = this.getChild(i + 1)
+      )
+    }
+
+    override string getConstantValue() { result = this.getConstantValue(0) }
+
+    /**
+     * Gets the single string matched by the `i`th child and all following
+     * children of this sequence, if any.
+     */
+    private string getConstantValue(int i) {
+      i = this.getNumChild() and
+      result = ""
+      or
+      result = this.getChild(i).getConstantValue() + this.getConstantValue(i + 1)
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpSequence" }
+
+    override predicate isNullable() {
+      forall(RegExpTerm child | child = this.getAChild() | child.isNullable())
+    }
+  }
+
+  pragma[nomagic]
+  private int seqChildEnd(RegExp re, int start, int end, int i) {
+    result = seqChild(re, start, end, i).getEnd()
+  }
+
+  // moved out so we can use it in the charpred
+  private RegExpTerm seqChild(RegExp re, int start, int end, int i) {
+    re.sequence(start, end) and
+    (
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      exists(int itemEnd |
+        re.item(start, itemEnd) and
+        result.getEnd() = itemEnd
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int itemStart | itemStart = seqChildEnd(re, start, end, i - 1) |
+        result.getStart() = itemStart and
+        re.item(itemStart, result.getEnd())
+      )
+    )
+  }
+
+  /**
+   * An alternative term, that is, a term of the form `a|b`.
+   *
+   * Example:
+   *
+   * ```
+   * ECMA|Java
+   * ```
+   */
+  class RegExpAlt extends RegExpTerm, TRegExpAlt {
+    RegExpAlt() { this = TRegExpAlt(re, start, end) }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      exists(int part_end |
+        re.alternationOption(start, end, start, part_end) and
+        result.getEnd() = part_end
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int part_start |
+        part_start = this.getChild(i - 1).getEnd() + 1 // allow for the |
+      |
+        result.getStart() = part_start and
+        re.alternationOption(start, end, part_start, result.getEnd())
+      )
+    }
+
+    /** Gets an alternative of this term. */
+    RegExpTerm getAlternative() { result = this.getAChild() }
+
+    override string getAMatchedString() { result = this.getAlternative().getAMatchedString() }
+
+    override string getAPrimaryQlClass() { result = "RegExpAlt" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * A character escape in a regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * \.
+   * ```
+   */
+  class RegExpCharEscape = RegExpEscape;
+
+  /**
+   * An escaped regular expression term, that is, a regular expression
+   * term starting with a backslash, which is not a backreference.
+   *
+   * Example:
+   *
+   * ```
+   * \.
+   * \w
+   * ```
+   */
+  class RegExpEscape extends RegExpNormalChar {
+    RegExpEscape() { re.escapedCharacter(start, end) }
+
+    /**
+     * Gets the name of the escaped; for example, `w` for `\w`.
+     * TODO: Handle named escapes.
+     */
+    override string getValue() {
+      not this.isUnicode() and
+      this.isIdentityEscape() and
+      result = this.getUnescaped()
+      or
+      this.getUnescaped() = "n" and result = "\n"
+      or
+      this.getUnescaped() = "r" and result = "\r"
+      or
+      this.getUnescaped() = "t" and result = "\t"
+      or
+      this.getUnescaped() = "f" and result = 12.toUnicode()
+      or
+      this.getUnescaped() = "v" and result = 11.toUnicode()
+      or
+      this.isUnicode() and
+      result = this.getUnicode()
+    }
+
+    /** Holds if this terms name is given by the part following the escape character. */
+    predicate isIdentityEscape() {
+      not this.getUnescaped() in ["n", "r", "t", "f", "v"] and not this.isUnicode()
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpEscape" }
+
+    /** Gets the part of the term following the escape character. That is e.g. "w" if the term is "\w". */
+    string getUnescaped() { result = this.getText().suffix(1) }
+
+    /**
+     * Gets the text for this escape. That is e.g. "\w".
+     */
+    private string getText() { result = re.getText().substring(start, end) }
+
+    /**
+     * Holds if this is a unicode escape.
+     */
+    private predicate isUnicode() { this.getText().prefix(2) = ["\\u", "\\U"] }
+
+    /**
+     * Gets the unicode char for this escape.
+     * E.g. for `\u0061` this returns "a".
+     */
+    private string getUnicode() {
+      this.isUnicode() and
+      result = parseHexInt(this.getText().suffix(2)).toUnicode()
+    }
+  }
+
+  /**
+   * A word boundary, that is, a regular expression term of the form `\b`.
+   */
+  class RegExpWordBoundary extends RegExpSpecialChar {
+    RegExpWordBoundary() { this.getChar() = "\\b" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A non-word boundary, that is, a regular expression term of the form `\B`.
+   */
+  class RegExpNonWordBoundary extends RegExpSpecialChar {
+    RegExpNonWordBoundary() { this.getChar() = "\\B" }
+
+    override string getAPrimaryQlClass() { result = "RegExpNonWordBoundary" }
+  }
+
+  /**
+   * A character class escape in a regular expression.
+   * That is, an escaped character that denotes multiple characters.
+   *
+   * Examples:
+   *
+   * ```
+   * \w
+   * \S
+   * ```
+   */
+  class RegExpCharacterClassEscape extends RegExpEscape {
+    RegExpCharacterClassEscape() { this.getValue() in ["d", "D", "s", "S", "w", "W"] }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterClassEscape" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A character class in a regular expression.
+   *
+   * Examples:
+   *
+   * ```cpp
+   * "[a-fA-F0-9]"
+   * "[^abc]"
+   * ```
+   */
+  class RegExpCharacterClass extends RegExpTerm, TRegExpCharacterClass {
+    RegExpCharacterClass() { this = TRegExpCharacterClass(re, start, end) }
+
+    /** Holds if this character class is inverted, matching the opposite of its content. */
+    predicate isInverted() { re.getChar(start + 1) = "^" }
+
+    /** Holds if this character class can match anything. */
+    predicate isUniversalClass() {
+      // [^]
+      this.isInverted() and not exists(this.getAChild())
+      or
+      // [\w\W] and similar
+      not this.isInverted() and
+      exists(string cce1, string cce2 |
+        cce1 = this.getAChild().(RegExpCharacterClassEscape).getValue() and
+        cce2 = this.getAChild().(RegExpCharacterClassEscape).getValue()
+      |
+        cce1 != cce2 and cce1.toLowerCase() = cce2.toLowerCase()
+      )
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      exists(int itemStart, int itemEnd |
+        result.getStart() = itemStart and
+        re.charSetStart(start, itemStart) and
+        re.charSetChild(start, itemStart, itemEnd) and
+        result.getEnd() = itemEnd
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int itemStart | itemStart = this.getChild(i - 1).getEnd() |
+        result.getStart() = itemStart and
+        re.charSetChild(start, itemStart, result.getEnd())
+      )
+    }
+
+    override string getAMatchedString() {
+      not this.isInverted() and result = this.getAChild().getAMatchedString()
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterClass" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A character range in a character class in a regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * a-z
+   * ```
+   */
+  class RegExpCharacterRange extends RegExpTerm, TRegExpCharacterRange {
+    int lower_end;
+    int upper_start;
+
+    RegExpCharacterRange() {
+      this = TRegExpCharacterRange(re, start, end) and
+      re.charRange(_, start, lower_end, upper_start, end)
+    }
+
+    /** Holds if this range goes from `lo` to `hi`, in effect is `lo-hi`. */
+    predicate isRange(string lo, string hi) {
+      lo = re.getText().substring(start, lower_end) and
+      hi = re.getText().substring(upper_start, end)
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      result.getEnd() = lower_end
+      or
+      i = 1 and
+      result.getRegExp() = re and
+      result.getStart() = upper_start and
+      result.getEnd() = end
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterRange" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A normal character in a regular expression, that is, a character
+   * without special meaning. This includes escaped characters.
+   *
+   * Examples:
+   * ```
+   * t
+   * \t
+   * ```
+   */
+  additional class RegExpNormalChar extends RegExpTerm, TRegExpNormalChar {
+    RegExpNormalChar() { this = TRegExpNormalChar(re, start, end) }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the string representation of the char matched by this term. */
+    string getValue() { result = re.getText().substring(start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpNormalChar" }
+  }
+
+  /**
+   * A constant regular expression term, that is, a regular expression
+   * term matching a single string. Currently, this will always be a single character.
+   *
+   * Example:
+   *
+   * ```
+   * a
+   * ```
+   */
+  class RegExpConstant extends RegExpTerm {
+    string value;
+
+    RegExpConstant() {
+      this = TRegExpNormalChar(re, start, end) and
+      not this instanceof RegExpCharacterClassEscape and
+      // exclude chars in qualifiers
+      // TODO: push this into regex library
+      not exists(int qstart, int qend | re.qualifiedPart(_, qstart, qend, _, _) |
+        qstart <= start and end <= qend
+      ) and
+      value = this.(RegExpNormalChar).getValue()
+      or
+      this = TRegExpSpecialChar(re, start, end) and
+      re.inCharSet(start) and
+      value = this.(RegExpSpecialChar).getChar()
+    }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the string matched by this constant term. */
+    string getValue() { result = value }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getConstantValue() { result = this.getValue() }
+
+    override string getAPrimaryQlClass() { result = "RegExpConstant" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A grouped regular expression.
+   *
+   * Examples:
+   *
+   * ```
+   * (ECMA|Java)
+   * (?:ECMA|Java)
+   * (?<quote>['"])
+   * ```
+   */
+  class RegExpGroup extends RegExpTerm, TRegExpGroup {
+    RegExpGroup() { this = TRegExpGroup(re, start, end) }
+
+    /**
+     * Gets the index of this capture group within the enclosing regular
+     * expression literal.
+     *
+     * For example, in the regular expression `/((a?).)(?:b)/`, the
+     * group `((a?).)` has index 1, the group `(a?)` nested inside it
+     * has index 2, and the group `(?:b)` has no index, since it is
+     * not a capture group.
+     */
+    int getNumber() { result = re.getGroupNumber(start, end) }
+
+    /** Holds if this is a capture group. */
+    predicate isCapture() { exists(this.getNumber()) }
+
+    /** Holds if this is a named capture group. */
+    predicate isNamed() { exists(this.getName()) }
+
+    /** Gets the name of this capture group, if any. */
+    string getName() { result = re.getGroupName(start, end) }
+
+    override RegExpTerm getChild(int i) {
+      result.getRegExp() = re and
+      i = 0 and
+      re.groupContents(start, end, result.getStart(), result.getEnd())
+    }
+
+    override string getConstantValue() { result = this.getAChild().getConstantValue() }
+
+    override string getAMatchedString() { result = this.getAChild().getAMatchedString() }
+
+    override string getAPrimaryQlClass() { result = "RegExpGroup" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * A special character in a regular expression.
+   *
+   * Examples:
+   * ```
+   * ^
+   * $
+   * .
+   * ```
+   */
+  additional class RegExpSpecialChar extends RegExpTerm, TRegExpSpecialChar {
+    string char;
+
+    RegExpSpecialChar() {
+      this = TRegExpSpecialChar(re, start, end) and
+      re.specialCharacter(start, end, char)
+    }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the char for this term. */
+    string getChar() { result = char }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpSpecialChar" }
+  }
+
+  /**
+   * A dot regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * .
+   * ```
+   */
+  class RegExpDot extends RegExpSpecialChar {
+    RegExpDot() { this.getChar() = "." }
+
+    override string getAPrimaryQlClass() { result = "RegExpDot" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A term that matches a specific position between characters in the string.
+   *
+   * Example:
+   *
+   * ```
+   * ^
+   * ```
+   */
+  class RegExpAnchor extends RegExpSpecialChar {
+    RegExpAnchor() { this.getChar() = ["^", "$"] }
+
+    override string getAPrimaryQlClass() { result = "RegExpAnchor" }
+  }
+
+  /**
+   * A dollar assertion `$` matching the end of a line.
+   *
+   * Example:
+   *
+   * ```
+   * $
+   * ```
+   */
+  class RegExpDollar extends RegExpAnchor {
+    RegExpDollar() { this.getChar() = "$" }
+
+    override string getAPrimaryQlClass() { result = "RegExpDollar" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A caret assertion `^` matching the beginning of a line.
+   *
+   * Example:
+   *
+   * ```
+   * ^
+   * ```
+   */
+  class RegExpCaret extends RegExpAnchor {
+    RegExpCaret() { this.getChar() = "^" }
+
+    override string getAPrimaryQlClass() { result = "RegExpCaret" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width match, that is, either an empty group or an assertion.
+   *
+   * Examples:
+   * ```
+   * ()
+   * (?=\w)
+   * ```
+   */
+  additional class RegExpZeroWidthMatch extends RegExpGroup {
+    RegExpZeroWidthMatch() { re.zeroWidthMatch(start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpZeroWidthMatch" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * (?!\n)
+   * ```
+   */
+  class RegExpSubPattern extends RegExpZeroWidthMatch {
+    RegExpSubPattern() { not re.emptyGroup(start, end) }
+
+    /** Gets the lookahead term. */
+    RegExpTerm getOperand() {
+      exists(int in_start, int in_end | re.groupContents(start, end, in_start, in_end) |
+        result.getRegExp() = re and
+        result.getStart() = in_start and
+        result.getEnd() = in_end
+      )
+    }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * (?!\n)
+   * ```
+   */
+  abstract class RegExpLookahead extends RegExpSubPattern { }
+
+  /**
+   * A positive-lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * ```
+   */
+  class RegExpPositiveLookahead extends RegExpLookahead {
+    RegExpPositiveLookahead() { re.positiveLookaheadAssertionGroup(start, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpPositiveLookahead" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A negative-lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?!\n)
+   * ```
+   */
+  additional class RegExpNegativeLookahead extends RegExpLookahead {
+    RegExpNegativeLookahead() { re.negativeLookaheadAssertionGroup(start, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpNegativeLookahead" }
+  }
+
+  abstract class RegExpLookbehind extends RegExpSubPattern { }
+
+  class RegExpPositiveLookbehind extends RegExpLookbehind {
+    RegExpPositiveLookbehind() { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpPositiveLookbehind" }
+  }
+
+  additional class RegExpNegativeLookbehind extends RegExpLookbehind {
+    RegExpNegativeLookbehind() { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpNegativeLookbehind" }
+  }
+
+  /**
+   * A back reference, that is, a term of the form `\i` or `\k<name>`
+   * in a regular expression.
+   *
+   * Examples:
+   *
+   * ```
+   * \1
+   * (?P=quote)
+   * ```
+   */
+  class RegExpBackRef extends RegExpTerm, TRegExpBackRef {
+    RegExpBackRef() { this = TRegExpBackRef(re, start, end) }
+
+    /**
+     * Gets the number of the capture group this back reference refers to, if any.
+     */
+    int getNumber() { result = re.getBackRefNumber(start, end) }
+
+    /**
+     * Gets the name of the capture group this back reference refers to, if any.
+     */
+    string getName() { result = re.getBackRefName(start, end) }
+
+    /** Gets the capture group this back reference refers to. */
+    RegExpGroup getGroup() {
+      result.getLiteral() = this.getLiteral() and
+      (
+        result.getNumber() = this.getNumber() or
+        result.getName() = this.getName()
+      )
+    }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpBackRef" }
+
+    override predicate isNullable() { this.getGroup().isNullable() }
+  }
+
+  additional class RegExpPosixCollatingSymbol extends RegExpTerm, TRegExpPosixCollatingSymbol {
+    RegExpPosixCollatingSymbol() { this = TRegExpPosixCollatingSymbol(re, start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpPosixCollatingSymbol" }
+
+    string getName() { re.posixStyleCollatingSymbol(start, end, result) }
+  }
+
+  additional class RegExpPosixEquivalenceClass extends RegExpTerm, TRegExpPosixEquivalenceClass {
+    RegExpPosixEquivalenceClass() { this = TRegExpPosixEquivalenceClass(re, start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpPosixEquivalenceClass" }
+
+    string getName() { re.posixStyleEquivalenceClass(start, end, result) }
+  }
+
+  class Top = RegExpParent;
+
+  /**
+   * Holds if `term` is an escape class representing e.g. `\d`.
+   * `clazz` is which character class it represents, e.g. "d" for `\d`.
+   */
+  predicate isEscapeClass(RegExpTerm term, string clazz) {
+    exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz)
+  }
+
+  /**
+   * Holds if the regular expression should not be considered.
+   */
+  predicate isExcluded(RegExpParent parent) { none() }
+
+  /**
+   * Holds if `term` is a possessive quantifier.
+   * Not currently implemented, but is used by the shared library.
+   */
+  predicate isPossessive(RegExpQuantifier term) { none() }
+
+  /**
+   * Holds if the regex that `term` is part of is used in a way that ignores any leading prefix of the input it's matched against.
+   * Not yet implemented for C++.
+   */
+  predicate matchesAnyPrefix(RegExpTerm term) { any() }
+
+  /**
+   * Holds if the regex that `term` is part of is used in a way that ignores any trailing suffix of the input it's matched against.
+   * Not yet implemented for C++.
+   */
+  predicate matchesAnySuffix(RegExpTerm term) { any() }
+
+  /**
+   * Holds if `root` has the `i` flag for case-insensitive matching.
+   */
+  predicate isIgnoreCase(RegExpTerm root) {
+    root.isRootTerm() and
+    root.getLiteral().isIgnoreCase()
+  }
+
+  /**
+   * Holds if `root` has the `s` flag for multi-line matching.
+   */
+  predicate isDotAll(RegExpTerm root) {
+    root.isRootTerm() and
+    root.getLiteral().isDotAll()
+  }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll b/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll
new file mode 100644
index 000000000000..739b2c884810
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll
@@ -0,0 +1,968 @@
+/**
+ * Library for parsing for C++ regular expressions.
+ *
+ * N.B. does not yet handle stripping whitespace and comments in regexes with
+ * the `x` (free-spacing) flag.
+ */
+
+private import semmle.code.cpp.exprs.Literal
+
+/**
+ * A C++ string literal containing a regular expression term, that is, either
+ * a regular expression literal, or a string literal used in a context where
+ * it is parsed as a regular expression.
+ */
+abstract class RegExp extends StringLiteral {
+  /**
+   * Holds if this `RegExp` has the `s` flag for multi-line matching.
+   */
+  predicate isDotAll() { none() }
+
+  /**
+   * Holds if this `RegExp` has the `i` flag for case-insensitive matching.
+   */
+  predicate isIgnoreCase() { none() }
+
+  /**
+   * Gets the flags for this `RegExp`, or the empty string if it has no flags.
+   */
+  string getFlags() { result = "" }
+
+  /**
+   * Helper predicate for `charSetStart(int start, int end)`.
+   *
+   * In order to identify left brackets ('[') which actually start a character class,
+   * we perform a left to right scan of the string.
+   *
+   * To avoid negative recursion we return a boolean. See `escaping`,
+   * the helper for `escapingChar`, for a clean use of this pattern.
+   *
+   * result is true for those start chars that actually mark a start of a char set.
+   */
+  boolean charSetStart(int pos) {
+    exists(int index |
+      // is opening bracket
+      this.charSetDelimiter(index, pos) = true and
+      (
+        // if this is the first bracket, `pos` starts a char set
+        index = 1 and result = true
+        or
+        // if the previous char set delimiter was not a closing bracket, `pos` does
+        // not start a char set. This is needed to handle cases such as `[[]` (a
+        // char set that matches the `[` char)
+        index > 1 and
+        not this.charSetDelimiter(index - 1, _) = false and
+        result = false
+        or
+        // special handling of cases such as `[][]` (the character-set of the characters `]` and `[`).
+        exists(int prevClosingBracketPos |
+          // previous bracket is a closing bracket
+          this.charSetDelimiter(index - 1, prevClosingBracketPos) = false and
+          if
+            // check if the character that comes before the previous closing bracket
+            // is an opening bracket (taking `^` into account)
+            // check if the character that comes before the previous closing bracket
+            // is an opening bracket (taking `^` into account)
+            exists(int posBeforePrevClosingBracket |
+              if this.getChar(prevClosingBracketPos - 1) = "^"
+              then posBeforePrevClosingBracket = prevClosingBracketPos - 2
+              else posBeforePrevClosingBracket = prevClosingBracketPos - 1
+            |
+              this.charSetDelimiter(index - 2, posBeforePrevClosingBracket) = true
+            )
+          then
+            // brackets without anything in between is not valid character ranges, so
+            // the first closing bracket in `[]]` and `[^]]` does not count,
+            //
+            // and we should _not_ mark the second opening bracket in `[][]` and `[^][]`
+            // as starting a new char set.                               ^           ^
+            exists(int posBeforePrevClosingBracket |
+              this.charSetDelimiter(index - 2, posBeforePrevClosingBracket) = true
+            |
+              result = this.charSetStart(posBeforePrevClosingBracket).booleanNot()
+            )
+          else
+            // if not, `pos` does in fact mark a real start of a character range
+            result = true
+        )
+      )
+    )
+  }
+
+  /**
+   * Helper predicate for chars that could be character-set delimiters.
+   * Holds if the (non-escaped) char at `pos` in the string, is the (one-based) `index` occurrence of a bracket (`[` or `]`) in the string.
+   * Result if `true` is the char is `[`, and `false` if the char is `]`.
+   */
+  boolean charSetDelimiter(int index, int pos) {
+    pos =
+      rank[index](int p |
+        (this.nonEscapedCharAt(p) = "[" or this.nonEscapedCharAt(p) = "]") and
+        // Brackets that art part of POSIX expressions should not count as
+        // char-set delimiters.
+        not exists(int x, int y |
+          (
+            this.posixStyleNamedCharacterProperty(x, y, _)
+            or
+            this.posixStyleCollatingSymbol(x, y, _)
+            or
+            this.posixStyleEquivalenceClass(x, y, _)
+          ) and
+          pos >= x and
+          pos < y
+        )
+      ) and
+    (
+      this.nonEscapedCharAt(pos) = "[" and result = true
+      or
+      this.nonEscapedCharAt(pos) = "]" and result = false
+    )
+  }
+
+  /** Holds if a character set starts between `start` and `end`. */
+  predicate charSetStart(int start, int end) {
+    this.charSetStart(start) = true and
+    (
+      this.getChar(start + 1) = "^" and end = start + 2
+      or
+      not this.getChar(start + 1) = "^" and end = start + 1
+    )
+  }
+
+  /** Whether there is a character class, between start (inclusive) and end (exclusive) */
+  predicate charSet(int start, int end) {
+    exists(int innerStart, int innerEnd |
+      this.charSetStart(start, innerStart) and
+      not this.charSetStart(_, start)
+    |
+      end = innerEnd + 1 and
+      innerEnd =
+        min(int e |
+          e > innerStart and
+          this.nonEscapedCharAt(e) = "]" and
+          not exists(int x, int y |
+            (
+              this.posixStyleNamedCharacterProperty(x, y, _)
+              or
+              this.posixStyleCollatingSymbol(x, y, _)
+              or
+              this.posixStyleEquivalenceClass(x, y, _)
+            ) and
+            e >= x and
+            e < y
+          )
+        |
+          e
+        )
+    )
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a `-` found between `start` and `end`.
+   */
+  private predicate charSetToken(int charsetStart, int index, int tokenStart, int tokenEnd) {
+    tokenStart =
+      rank[index](int start, int end | this.charSetToken(charsetStart, start, end) | start) and
+    this.charSetToken(charsetStart, tokenStart, tokenEnd)
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a `-` found between `start` and `end`.
+   */
+  private predicate charSetToken(int charsetStart, int start, int end) {
+    this.charSetStart(charsetStart, start) and
+    (
+      this.escapedCharacter(start, end)
+      or
+      this.namedCharacterProperty(start, end, _)
+      or
+      this.posixStyleCollatingSymbol(start, end, _)
+      or
+      this.posixStyleEquivalenceClass(start, end, _)
+      or
+      exists(this.nonEscapedCharAt(start)) and end = start + 1
+    )
+    or
+    this.charSetToken(charsetStart, _, start) and
+    (
+      this.escapedCharacter(start, end)
+      or
+      this.namedCharacterProperty(start, end, _)
+      or
+      this.posixStyleCollatingSymbol(start, end, _)
+      or
+      this.posixStyleEquivalenceClass(start, end, _)
+      or
+      exists(this.nonEscapedCharAt(start)) and
+      end = start + 1 and
+      not this.getChar(start) = "]"
+    )
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a range found between `start` and `end`.
+   */
+  predicate charSetChild(int charsetStart, int start, int end) {
+    this.charSetToken(charsetStart, start, end) and
+    not exists(int rangeStart, int rangeEnd |
+      this.charRange(charsetStart, rangeStart, _, _, rangeEnd) and
+      rangeStart <= start and
+      rangeEnd >= end
+    )
+    or
+    this.charRange(charsetStart, start, _, _, end)
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains a character range
+   * with lower bound found between `start` and `lowerEnd`
+   * and upper bound found between `upperStart` and `end`.
+   */
+  predicate charRange(int charsetStart, int start, int lowerEnd, int upperStart, int end) {
+    exists(int index |
+      this.charRangeEnd(charsetStart, index) = true and
+      this.charSetToken(charsetStart, index - 2, start, lowerEnd) and
+      this.charSetToken(charsetStart, index, upperStart, end)
+    )
+  }
+
+  /**
+   * Helper predicate for `charRange`.
+   * We can determine where character ranges end by a left to right sweep.
+   *
+   * To avoid negative recursion we return a boolean. See `escaping`,
+   * the helper for `escapingChar`, for a clean use of this pattern.
+   */
+  private boolean charRangeEnd(int charsetStart, int index) {
+    this.charSetToken(charsetStart, index, _, _) and
+    (
+      index in [1, 2] and result = false
+      or
+      index > 2 and
+      exists(int connectorStart |
+        this.charSetToken(charsetStart, index - 1, connectorStart, _) and
+        this.nonEscapedCharAt(connectorStart) = "-" and
+        result =
+          this.charRangeEnd(charsetStart, index - 2)
+              .booleanNot()
+              .booleanAnd(this.charRangeEnd(charsetStart, index - 1).booleanNot())
+      )
+      or
+      not exists(int connectorStart |
+        this.charSetToken(charsetStart, index - 1, connectorStart, _) and
+        this.nonEscapedCharAt(connectorStart) = "-"
+      ) and
+      result = false
+    )
+  }
+
+  /** Holds if the character at `pos` is a "\" that is actually escaping what comes after. */
+  predicate escapingChar(int pos) { this.escaping(pos) = true }
+
+  /**
+   * Helper predicate for `escapingChar`.
+   * In order to avoid negative recursion, we return a boolean.
+   * This way, we can refer to `escaping(pos - 1).booleanNot()`
+   * rather than to a negated version of `escaping(pos)`.
+   */
+  private boolean escaping(int pos) {
+    pos = -1 and result = false
+    or
+    this.getChar(pos) = "\\" and result = this.escaping(pos - 1).booleanNot()
+    or
+    this.getChar(pos) != "\\" and result = false
+  }
+
+  /** Gets the text of this regex */
+  string getText() { result = this.getValue() }
+
+  /** Gets the `i`th character of this regex */
+  string getChar(int i) { result = this.getText().charAt(i) }
+
+  /** Gets the `i`th character of this regex, unless it is part of a character escape sequence. */
+  string nonEscapedCharAt(int i) {
+    result = this.getText().charAt(i) and
+    not exists(int x, int y | this.escapedCharacter(x, y) and i in [x .. y - 1])
+  }
+
+  private predicate isOptionDivider(int i) { this.nonEscapedCharAt(i) = "|" }
+
+  private predicate isGroupEnd(int i) { this.nonEscapedCharAt(i) = ")" and not this.inCharSet(i) }
+
+  private predicate isGroupStart(int i) { this.nonEscapedCharAt(i) = "(" and not this.inCharSet(i) }
+
+  /**
+   * Holds if the `i`th character could not be parsed.
+   */
+  predicate failedToParse(int i) {
+    exists(this.getChar(i)) and
+    not exists(int start, int end |
+      this.topLevel(start, end) and
+      start <= i and
+      end > i
+    )
+  }
+
+  /** Matches named character properties such as `[[:digit:]]` */
+  predicate namedCharacterProperty(int start, int end, string name) {
+    this.posixStyleNamedCharacterProperty(start, end, name)
+  }
+
+  /** Gets the name of the character property in start,end */
+  string getCharacterPropertyName(int start, int end) {
+    this.namedCharacterProperty(start, end, result)
+  }
+
+  /** Matches a POSIX bracket expression such as `[:alnum:]` within a character class. */
+  private predicate posixStyleNamedCharacterProperty(int start, int end, string name) {
+    this.getChar(start) = "[" and
+    this.getChar(start + 1) = ":" and
+    end =
+      min(int e |
+        e > start and
+        this.getChar(e - 2) = ":" and
+        this.getChar(e - 1) = "]"
+      |
+        e
+      ) and
+    exists(int nameStart |
+      this.getChar(start + 2) = "^" and nameStart = start + 3
+      or
+      not this.getChar(start + 2) = "^" and nameStart = start + 2
+    |
+      name = this.getText().substring(nameStart, end - 2)
+    )
+  }
+
+  /** Matches a POSIX collating symbol such as `[.ch.]` within a character class. */
+  predicate posixStyleCollatingSymbol(int start, int end, string name) {
+    this.getChar(start) = "[" and
+    this.getChar(start + 1) = "." and
+    end =
+      min(int e |
+        e > start and
+        this.getChar(e - 2) = "." and
+        this.getChar(e - 1) = "]"
+      |
+        e
+      ) and
+    name = this.getText().substring(start + 2, end - 2)
+  }
+
+  /** Matches a POSIX equivalence class such as `[=a=]` within a character class. */
+  predicate posixStyleEquivalenceClass(int start, int end, string name) {
+    this.getChar(start) = "[" and
+    this.getChar(start + 1) = "=" and
+    end =
+      min(int e |
+        e > start and
+        this.getChar(e - 2) = "=" and
+        this.getChar(e - 1) = "]"
+      |
+        e
+      ) and
+    name = this.getText().substring(start + 2, end - 2)
+  }
+
+  /**
+   * Holds if the named character property is inverted. Examples for which it holds:
+   * - `\P{Digit}` upper-case P means inverted
+   * - `\p{^Word}` caret also means inverted
+   * - `[[:^digit:]]`
+   *
+   * Examples for which it doesn't hold:
+   * - `\p{Word}`
+   * - `\P{^Space}` - upper-case P and caret cancel each other out
+   * - `[[:alnum:]]`
+   */
+  predicate namedCharacterPropertyIsInverted(int start, int end) {
+    this.posixStyleNamedCharacterProperty(start, end, _) and
+    this.getChar(start + 3) = "^"
+  }
+
+  /**
+   * Holds if an escaped character is found between `start` and `end`.
+   * Escaped characters include hex values, octal values and named escapes,
+   * but excludes backreferences.
+   */
+  predicate escapedCharacter(int start, int end) {
+    this.escapingChar(start) and
+    not this.numberedBackreference(start, _, _) and
+    (
+      // hex char \xhh
+      this.getChar(start + 1) = "x" and end = start + 4
+      or
+      // wide hex char \uhhhh
+      this.getChar(start + 1) = "u" and end = start + 6
+      or
+      // control char \cX
+      this.getChar(start + 1) = "c" and end = start + 3
+      or
+      // nul escape \0 (when not followed by a digit)
+      this.getChar(start + 1) = "0" and
+      end = start + 2 and
+      not exists(this.getChar(start + 2).toInt())
+      or
+      // escape not handled above; update when adding a new case
+      not this.getChar(start + 1) in ["x", "u", "c"] and
+      not exists(this.getChar(start + 1).toInt()) and
+      end = start + 2
+    )
+  }
+
+  /**
+   * Holds if the character at `index` is inside a character set.
+   */
+  predicate inCharSet(int index) {
+    exists(int x, int y | this.charSet(x, y) and index in [x + 1 .. y - 2])
+  }
+
+  /**
+   * Holds if the character at `index` is inside a posix bracket.
+   */
+  predicate inPosixBracket(int index) {
+    exists(int x, int y |
+      (
+        this.posixStyleNamedCharacterProperty(x, y, _)
+        or
+        this.posixStyleCollatingSymbol(x, y, _)
+        or
+        this.posixStyleEquivalenceClass(x, y, _)
+      ) and
+      index in [x + 1 .. y - 2]
+    )
+  }
+
+  /**
+   * 'simple' characters are any that don't alter the parsing of the regex.
+   */
+  private predicate simpleCharacter(int start, int end) {
+    end = start + 1 and
+    not this.charSet(start, _) and
+    not this.charSet(_, start + 1) and
+    not exists(int x, int y |
+      (
+        this.posixStyleNamedCharacterProperty(x, y, _)
+        or
+        this.posixStyleCollatingSymbol(x, y, _)
+        or
+        this.posixStyleEquivalenceClass(x, y, _)
+      ) and
+      start >= x and
+      end <= y
+    ) and
+    exists(string c | c = this.getChar(start) |
+      exists(int x, int y, int z |
+        this.charSet(x, z) and
+        this.charSetStart(x, y)
+      |
+        start = y
+        or
+        start = z - 2
+        or
+        start > y and start < z - 2 and not this.charRange(_, _, start, end, _)
+      )
+      or
+      not this.inCharSet(start) and
+      not c = "(" and
+      not c = "[" and
+      not c = ")" and
+      not c = "|" and
+      not this.qualifier(start, _, _, _)
+    )
+  }
+
+  /**
+   * Holds if a simple or escaped character is found between `start` and `end`.
+   */
+  predicate character(int start, int end) {
+    (
+      this.simpleCharacter(start, end) and
+      not exists(int x, int y | this.escapedCharacter(x, y) and x <= start and y >= end)
+      or
+      this.escapedCharacter(start, end)
+    ) and
+    not exists(int x, int y | this.groupStart(x, y) and x <= start and y >= end) and
+    not exists(int x, int y | this.backreference(x, y) and x <= start and y >= end) and
+    not exists(int x, int y | this.multiples(x, y, _, _) and x <= start and y >= end)
+  }
+
+  /**
+   * Holds if a normal character is found between `start` and `end`.
+   */
+  predicate normalCharacter(int start, int end) {
+    end = start + 1 and
+    this.character(start, end) and
+    not this.specialCharacter(start, end, _)
+  }
+
+  /**
+   * Holds if a special character is found between `start` and `end`.
+   */
+  predicate specialCharacter(int start, int end, string char) {
+    this.character(start, end) and
+    not this.inCharSet(start) and
+    (
+      end = start + 1 and
+      char = this.getChar(start) and
+      (char = "$" or char = "^" or char = ".")
+      or
+      end = start + 2 and
+      this.escapingChar(start) and
+      char = this.getText().substring(start, end) and
+      char = ["\\b", "\\B"]
+    )
+  }
+
+  /**
+   * Holds if the range [start:end) consists of only 'normal' characters.
+   */
+  predicate normalCharacterSequence(int start, int end) {
+    // a normal character inside a character set is interpreted on its own
+    this.normalCharacter(start, end) and
+    this.inCharSet(start)
+    or
+    // a maximal run of normal characters is considered as one constant
+    exists(int s, int e |
+      e = max(int i | this.normalCharacterRun(s, i)) and
+      not this.inCharSet(s)
+    |
+      // 'abc' can be considered one constant, but
+      // 'abc+' has to be broken up into 'ab' and 'c+',
+      // as the qualifier only applies to 'c'.
+      if this.qualifier(e, _, _, _)
+      then
+        end = e and start = e - 1
+        or
+        end = e - 1 and start = s and start < end
+      else (
+        end = e and
+        start = s
+      )
+    )
+  }
+
+  private predicate normalCharacterRun(int start, int end) {
+    (
+      this.normalCharacterRun(start, end - 1)
+      or
+      start = end - 1 and not this.normalCharacter(start - 1, start)
+    ) and
+    this.normalCharacter(end - 1, end)
+  }
+
+  private predicate characterItem(int start, int end) {
+    this.normalCharacterSequence(start, end) or
+    this.escapedCharacter(start, end) or
+    this.specialCharacter(start, end, _)
+  }
+
+  /** Whether the text in the range `start,end` is a group */
+  predicate group(int start, int end) {
+    this.groupContents(start, end, _, _)
+    or
+    this.emptyGroup(start, end)
+  }
+
+  /** Gets the number of the group in start,end */
+  int getGroupNumber(int start, int end) {
+    this.group(start, end) and
+    not this.nonCapturingGroupStart(start, _) and
+    result =
+      count(int i | this.group(i, _) and i < start and not this.nonCapturingGroupStart(i, _)) + 1
+  }
+
+  /** Gets the name, if it has one, of the group in start,end */
+  string getGroupName(int start, int end) { none() }
+
+  /** Whether the text in the range start, end is a group and can match the empty string. */
+  predicate zeroWidthMatch(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+    or
+    this.positiveLookaheadAssertionGroup(start, end)
+  }
+
+  /** Holds if an empty group is found between `start` and `end`. */
+  predicate emptyGroup(int start, int end) {
+    exists(int endm1 | end = endm1 + 1 |
+      this.groupStart(start, endm1) and
+      this.isGroupEnd(endm1)
+    )
+  }
+
+  private predicate emptyMatchAtStartGroup(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+    or
+    this.positiveLookaheadAssertionGroup(start, end)
+  }
+
+  private predicate emptyMatchAtEndGroup(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+  }
+
+  private predicate negativeAssertionGroup(int start, int end) {
+    exists(int inStart | this.negativeLookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  /** Holds if a negative lookahead is found between `start` and `end` */
+  predicate negativeLookaheadAssertionGroup(int start, int end) {
+    exists(int inStart | this.negativeLookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  /** Holds if a positive lookahead is found between `start` and `end` */
+  predicate positiveLookaheadAssertionGroup(int start, int end) {
+    exists(int inStart | this.lookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  private predicate groupStart(int start, int end) {
+    this.nonCapturingGroupStart(start, end)
+    or
+    this.lookaheadAssertionStart(start, end)
+    or
+    this.negativeLookaheadAssertionStart(start, end)
+    or
+    this.simpleGroupStart(start, end)
+  }
+
+  /** Matches the start of a non-capturing group, e.g. `(?:` */
+  private predicate nonCapturingGroupStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = [":", "=", "!", "#"] and
+    end = start + 3
+  }
+
+  /** Matches the start of a simple group, e.g. `(a+)`. */
+  private predicate simpleGroupStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) != "?" and
+    end = start + 1
+  }
+
+  /** Matches the start of a positive lookahead assertion, i.e. `(?=`. */
+  private predicate lookaheadAssertionStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = "=" and
+    end = start + 3
+  }
+
+  /** Matches the start of a negative lookahead assertion, i.e. `(?!`. */
+  private predicate negativeLookaheadAssertionStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = "!" and
+    end = start + 3
+  }
+
+  /** Matches the contents of a group. */
+  predicate groupContents(int start, int end, int inStart, int inEnd) {
+    this.groupStart(start, inStart) and
+    end = inEnd + 1 and
+    this.topLevel(inStart, inEnd) and
+    this.isGroupEnd(inEnd)
+  }
+
+  /** Matches a numbered backreference, e.g. `\1`. */
+  predicate numberedBackreference(int start, int end, int value) {
+    this.escapingChar(start) and
+    not this.getChar(start + 1) = "0" and
+    exists(string text, string svalue, int len |
+      end = start + len and
+      text = this.getText() and
+      len in [2 .. 3]
+    |
+      svalue = text.substring(start + 1, start + len) and
+      value = svalue.toInt() and
+      not exists(text.substring(start + 1, start + len + 1).toInt()) and
+      value > 0
+    )
+  }
+
+  /** Whether the text in the range `start,end` is a back reference */
+  predicate backreference(int start, int end) {
+    this.numberedBackreference(start, end, _)
+  }
+
+  /** Gets the number of the back reference in start,end */
+  int getBackRefNumber(int start, int end) { this.numberedBackreference(start, end, result) }
+
+  /** Gets the name, if it has one, of the back reference in start,end */
+  string getBackRefName(int start, int end) { none() }
+
+  private predicate baseItem(int start, int end) {
+    this.characterItem(start, end) and
+    not exists(int x, int y | this.charSet(x, y) and x <= start and y >= end)
+    or
+    this.group(start, end)
+    or
+    this.charSet(start, end)
+    or
+    this.backreference(start, end)
+  }
+
+  private predicate qualifier(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    this.shortQualifier(start, end, maybeEmpty, mayRepeatForever) and
+    not this.getChar(end) = "?"
+    or
+    exists(int shortEnd | this.shortQualifier(start, shortEnd, maybeEmpty, mayRepeatForever) |
+      if this.getChar(shortEnd) = "?" then end = shortEnd + 1 else end = shortEnd
+    )
+  }
+
+  private predicate shortQualifier(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    (
+      this.getChar(start) = "+" and maybeEmpty = false and mayRepeatForever = true
+      or
+      this.getChar(start) = "*" and maybeEmpty = true and mayRepeatForever = true
+      or
+      this.getChar(start) = "?" and maybeEmpty = true and mayRepeatForever = false
+    ) and
+    end = start + 1
+    or
+    exists(string lower, string upper |
+      this.multiples(start, end, lower, upper) and
+      (if lower = "" or lower.toInt() = 0 then maybeEmpty = true else maybeEmpty = false) and
+      if upper = "" then mayRepeatForever = true else mayRepeatForever = false
+    )
+  }
+
+  /**
+   * Holds if a repetition quantifier is found between `start` and `end`,
+   * with the given lower and upper bounds. If a bound is omitted, the corresponding
+   * string is empty.
+   */
+  predicate multiples(int start, int end, string lower, string upper) {
+    exists(string text, string match, string inner |
+      text = this.getText() and
+      end = start + match.length() and
+      inner = match.substring(1, match.length() - 1)
+    |
+      match = text.regexpFind("\\{[0-9]+\\}", _, start) and
+      lower = inner and
+      upper = lower
+      or
+      match = text.regexpFind("\\{[0-9]*,[0-9]*\\}", _, start) and
+      exists(int commaIndex |
+        commaIndex = inner.indexOf(",") and
+        lower = inner.prefix(commaIndex) and
+        upper = inner.suffix(commaIndex + 1)
+      )
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is a qualified item, where item is a character,
+   * a character set or a group.
+   */
+  predicate qualifiedItem(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    this.qualifiedPart(start, _, end, maybeEmpty, mayRepeatForever)
+  }
+
+  /**
+   * Holds if a qualified part is found between `start` and `partEnd` and the qualifier is
+   * found between `partEnd` and `end`.
+   *
+   * `maybeEmpty` is true if the part is optional.
+   * `mayRepeatForever` is true if the part may be repeated unboundedly.
+   */
+  predicate qualifiedPart(
+    int start, int partEnd, int end, boolean maybeEmpty, boolean mayRepeatForever
+  ) {
+    this.baseItem(start, partEnd) and
+    this.qualifier(partEnd, end, maybeEmpty, mayRepeatForever)
+  }
+
+  /** Holds if the range `start`, `end` contains a character, a quantifier, a character set or a group. */
+  predicate item(int start, int end) {
+    this.qualifiedItem(start, end, _, _)
+    or
+    this.baseItem(start, end) and not this.qualifier(end, _, _, _)
+  }
+
+  private predicate subsequence(int start, int end) {
+    (
+      start = 0 or
+      this.groupStart(_, start) or
+      this.isOptionDivider(start - 1)
+    ) and
+    this.item(start, end)
+    or
+    exists(int mid |
+      this.subsequence(start, mid) and
+      this.item(mid, end)
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is a sequence of 1 or more items, where an item is a character,
+   * a character set or a group.
+   */
+  predicate sequence(int start, int end) {
+    this.sequenceOrQualified(start, end) and
+    not this.qualifiedItem(start, end, _, _)
+  }
+
+  private predicate sequenceOrQualified(int start, int end) {
+    this.subsequence(start, end) and
+    not this.itemStart(end)
+  }
+
+  private predicate itemStart(int start) {
+    this.characterItem(start, _) or
+    this.isGroupStart(start) or
+    this.charSet(start, _) or
+    this.backreference(start, _) or
+    this.namedCharacterProperty(start, _, _)
+  }
+
+  private predicate itemEnd(int end) {
+    this.characterItem(_, end)
+    or
+    exists(int endm1 | this.isGroupEnd(endm1) and end = endm1 + 1)
+    or
+    this.charSet(_, end)
+    or
+    this.qualifier(_, end, _, _)
+  }
+
+  private predicate topLevel(int start, int end) {
+    this.subalternation(start, end, _) and
+    not this.isOptionDivider(end)
+  }
+
+  private predicate subalternation(int start, int end, int itemStart) {
+    this.sequenceOrQualified(start, end) and
+    not this.isOptionDivider(start - 1) and
+    itemStart = start
+    or
+    start = end and
+    not this.itemEnd(start) and
+    this.isOptionDivider(end) and
+    itemStart = start
+    or
+    exists(int mid |
+      this.subalternation(start, mid, _) and
+      this.isOptionDivider(mid) and
+      itemStart = mid + 1
+    |
+      this.sequenceOrQualified(itemStart, end)
+      or
+      not this.itemStart(end) and end = itemStart
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is an alternation
+   */
+  predicate alternation(int start, int end) {
+    not this.inCharSet(start) and
+    this.topLevel(start, end) and
+    exists(int less | this.subalternation(start, less, _) and less < end)
+  }
+
+  /**
+   * Whether the text in the range start,end is an alternation and the text in partStart, partEnd is one of the
+   * options in that alternation.
+   */
+  predicate alternationOption(int start, int end, int partStart, int partEnd) {
+    this.alternation(start, end) and
+    this.subalternation(start, partEnd, partStart)
+  }
+
+  /** A part of the regex that may match the start of the string. */
+  private predicate firstPart(int start, int end) {
+    start = 0 and end = this.getText().length()
+    or
+    exists(int x | this.firstPart(x, end) |
+      this.emptyMatchAtStartGroup(x, start)
+      or
+      this.qualifiedItem(x, start, true, _)
+      or
+      // ^ matches the start of the string
+      this.specialCharacter(x, start, "^")
+    )
+    or
+    exists(int y | this.firstPart(start, y) |
+      this.item(start, end)
+      or
+      this.qualifiedPart(start, end, y, _, _)
+    )
+    or
+    exists(int x, int y | this.firstPart(x, y) |
+      this.groupContents(x, y, start, end)
+      or
+      this.alternationOption(x, y, start, end)
+    )
+  }
+
+  /** A part of the regex that may match the end of the string. */
+  private predicate lastPart(int start, int end) {
+    start = 0 and end = this.getText().length()
+    or
+    exists(int y | this.lastPart(start, y) |
+      this.emptyMatchAtEndGroup(end, y)
+      or
+      this.qualifiedItem(end, y, true, _)
+      or
+      // $ matches the end of the string.
+      this.specialCharacter(end, y, "$")
+    )
+    or
+    this.lastPart(_, end) and
+    this.item(start, end)
+    or
+    exists(int y | this.lastPart(start, y) | this.qualifiedPart(start, end, y, _, _))
+    or
+    exists(int x, int y | this.lastPart(x, y) |
+      this.groupContents(x, y, start, end)
+      or
+      this.alternationOption(x, y, start, end)
+    )
+  }
+
+  /**
+   * Whether the item at [start, end) is one of the first items
+   * to be matched.
+   */
+  predicate firstItem(int start, int end) {
+    (
+      this.characterItem(start, end)
+      or
+      this.qualifiedItem(start, end, _, _)
+      or
+      this.charSet(start, end)
+    ) and
+    this.firstPart(start, end)
+  }
+
+  /**
+   * Whether the item at [start, end) is one of the last items
+   * to be matched.
+   */
+  predicate lastItem(int start, int end) {
+    (
+      this.characterItem(start, end)
+      or
+      this.qualifiedItem(start, end, _, _)
+      or
+      this.charSet(start, end)
+    ) and
+    this.lastPart(start, end)
+  }
+}
diff --git a/cpp/ql/test/library-tests/regex/locations.expected b/cpp/ql/test/library-tests/regex/locations.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/regex/locations.ql b/cpp/ql/test/library-tests/regex/locations.ql
new file mode 100644
index 000000000000..f102f98a1b0a
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/locations.ql
@@ -0,0 +1,5 @@
+import semmle.code.cpp.regex.RegexTreeView
+
+from RegExpTerm t, string file, int sl, int sc, int el, int ec
+where t.isRootTerm() and t.hasLocationInfo(file, sl, sc, el, ec)
+select t, file, sl, sc, el, ec
diff --git a/cpp/ql/test/library-tests/regex/parse.expected b/cpp/ql/test/library-tests/regex/parse.expected
new file mode 100644
index 000000000000..80833567ffce
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/parse.expected
@@ -0,0 +1,488 @@
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpEscape] \n
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpEscape] \f
+
+#-----| [RegExpConstant, RegExpEscape] \v
+
+#-----| [RegExpConstant, RegExpNormalChar] d
+
+#-----| [RegExpConstant, RegExpNormalChar] c
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpEscape] \0
+
+#-----| [RegExpConstant, RegExpEscape] \0
+
+#-----| [RegExpConstant, RegExpEscape] \cZ
+
+#-----| [RegExpConstant, RegExpEscape] \cA
+
+#-----| [RegExpConstant, RegExpEscape] \u0061
+
+#-----| [RegExpConstant, RegExpNormalChar] A
+
+#-----| [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpConstant, RegExpNormalChar] [
+
+#-----| [RegExpConstant, RegExpNormalChar] a-f]
+
+#-----| [RegExpConstant, RegExpNormalChar] A
+
+#-----| [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpConstant, RegExpNormalChar] [
+
+#-----| [RegExpConstant, RegExpNormalChar] a-f]
+
+#-----| [RegExpConstant, RegExpNormalChar] A
+
+#-----| [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] :
+
+#-----| [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] cd
+
+#-----| [RegExpConstant, RegExpNormalChar] e
+
+#-----| [RegExpConstant, RegExpNormalChar] fo
+
+#-----| [RegExpConstant, RegExpNormalChar] o
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] ar
+
+#-----| [RegExpConstant, RegExpNormalChar] foo
+
+#-----| [RegExpConstant, RegExpNormalChar] bar
+
+#-----| [RegExpConstant, RegExpNormalChar] !a
+
+#-----| [RegExpConstant, RegExpEscape] \n
+
+#-----| [RegExpConstant, RegExpEscape] \r
+
+#-----| [RegExpConstant, RegExpEscape] \t
+
+#-----| [RegExpCharacterClassEscape] \d
+
+#-----| [RegExpCharacterClassEscape] \D
+
+#-----| [RegExpCharacterClassEscape] \s
+
+#-----| [RegExpCharacterClassEscape] \S
+
+#-----| [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpCharacterClassEscape] \W
+
+#-----| [RegExpConstant, RegExpNormalChar] [
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpConstant, RegExpNormalChar] A-F]
+
+#-----| [RegExpConstant, RegExpEscape] \b
+
+#-----| [RegExpConstant, RegExpNormalChar] |
+
+#-----| [RegExpConstant, RegExpNormalChar] -
+
+#-----| [RegExpConstant, RegExpNormalChar] ]
+
+#-----| [RegExpConstant, RegExpNormalChar] ]
+
+#-----| [RegExpConstant, RegExpNormalChar] A
+
+#-----| [RegExpConstant, RegExpNormalChar] Z
+
+#-----| [RegExpConstant, RegExpEscape] \[
+
+#-----| [RegExpConstant, RegExpEscape] \]
+
+#-----| [RegExpConstant, RegExpNormalChar] 1
+
+#-----| [RegExpConstant, RegExpNormalChar] 2
+
+#-----| [RegExpConstant, RegExpNormalChar] 3
+
+#-----| [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpConstant, RegExpNormalChar] A
+
+#-----| [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpConstant, RegExpNormalChar] 0
+
+#-----| [RegExpConstant, RegExpNormalChar] 9
+
+#-----| [RegExpConstant, RegExpNormalChar] _
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] c
+
+#-----| [RegExpConstant, RegExpNormalChar] foo
+
+#-----| [RegExpConstant, RegExpNormalChar] bar
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpConstant, RegExpNormalChar] c
+
+#-----| [RegExpConstant, RegExpNormalChar] d
+
+#-----| [RegExpConstant, RegExpNormalChar] abc
+
+#-----| [RegExpSequence] a\nb
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpSequence] \f\v
+#-----| 0 -> [RegExpConstant, RegExpEscape] \f
+#-----| 1 -> [RegExpConstant, RegExpEscape] \v
+
+#-----| [RegExpSequence] [A-F[[=b=]]a-f]
+#-----| 0 -> [RegExpCharacterClass] [A-F[[=b=]]
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] a-f]
+
+#-----| [RegExpSequence] [A-F[[.b.]]a-f]
+#-----| 0 -> [RegExpCharacterClass] [A-F[[.b.]]
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] a-f]
+
+#-----| [RegExpSequence] [[:alpha:]][[:digit:]]
+#-----| 0 -> [RegExpCharacterClass] [[:alpha:]]
+#-----| 1 -> [RegExpCharacterClass] [[:digit:]]
+
+#-----| [RegExpSequence] (a+)b+\1
+#-----| 0 -> [RegExpGroup] (a+)
+#-----| 1 -> [RegExpPlus] b+
+#-----| 2 -> [RegExpBackRef] \1
+
+#-----| [RegExpSequence] (?::+)\w
+#-----| 0 -> [RegExpGroup] (?::+)
+#-----| 1 -> [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpSequence] (a|b|cd)e
+#-----| 0 -> [RegExpGroup] (a|b|cd)
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] e
+
+#-----| [RegExpSequence] fo(o|b)ar
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] fo
+#-----| 1 -> [RegExpGroup] (o|b)
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] ar
+
+#-----| [RegExpSequence] (foo)*bar
+#-----| 0 -> [RegExpStar] (foo)*
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] bar
+
+#-----| [RegExpSequence] \b!a\B
+#-----| 0 -> [RegExpSpecialChar] \b
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] !a
+#-----| 2 -> [RegExpNonWordBoundary] \B
+
+#-----| [RegExpSequence] \n\r\t
+#-----| 0 -> [RegExpConstant, RegExpEscape] \n
+#-----| 1 -> [RegExpConstant, RegExpEscape] \r
+#-----| 2 -> [RegExpConstant, RegExpEscape] \t
+
+#-----| [RegExpSequence] \d\D
+#-----| 0 -> [RegExpCharacterClassEscape] \d
+#-----| 1 -> [RegExpCharacterClassEscape] \D
+
+#-----| [RegExpSequence] \s\S
+#-----| 0 -> [RegExpCharacterClassEscape] \s
+#-----| 1 -> [RegExpCharacterClassEscape] \S
+
+#-----| [RegExpSequence] \w+\W
+#-----| 0 -> [RegExpPlus] \w+
+#-----| 1 -> [RegExpCharacterClassEscape] \W
+
+#-----| [RegExpSequence] [[a-f]A-F]
+#-----| 0 -> [RegExpCharacterClass] [[a-f]
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] A-F]
+
+#-----| [RegExpSequence] \[\][123]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \[
+#-----| 1 -> [RegExpConstant, RegExpEscape] \]
+#-----| 2 -> [RegExpCharacterClass] [123]
+
+#-----| [RegExpSequence] a*b+c?d
+#-----| 0 -> [RegExpStar] a*
+#-----| 1 -> [RegExpPlus] b+
+#-----| 2 -> [RegExpOpt] c?
+#-----| 3 -> [RegExpConstant, RegExpNormalChar] d
+
+#-----| [RegExpPosixEquivalenceClass] [=b=]
+
+#-----| [RegExpPosixEquivalenceClass] [=a=]
+
+#-----| [RegExpPosixCollatingSymbol] [.b.]
+
+#-----| [RegExpPosixCollatingSymbol] [.a.]
+
+#-----| [RegExpBackRef] \1
+
+#-----| [RegExpSpecialChar] \b
+
+#-----| [RegExpNonWordBoundary] \B
+
+#-----| [RegExpDot] .
+
+#-----| [RegExpDot] .
+
+#-----| [RegExpGroup] (a+)
+#-----| 0 -> [RegExpPlus] a+
+
+#-----| [RegExpGroup] (?::+)
+#-----| 0 -> [RegExpPlus] :+
+
+#-----| [RegExpGroup] (a|b|cd)
+#-----| 0 -> [RegExpAlt] a|b|cd
+
+#-----| [RegExpGroup] (o|b)
+#-----| 0 -> [RegExpAlt] o|b
+
+#-----| [RegExpGroup] (foo)
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] foo
+
+#-----| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpCharacterRange] A-Z
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] Z
+
+#-----| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#-----| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#-----| [RegExpCharacterRange] 0-9
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] 0
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] 9
+
+#-----| [RegExpCharacterClass] [\0]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \0
+
+#-----| [RegExpCharacterClass] [\cZ]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \cZ
+
+#-----| [RegExpCharacterClass] [A-F[[=b=]]
+#-----| 0 -> [RegExpCharacterRange] A-F
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] [
+#-----| 2 -> [RegExpPosixEquivalenceClass] [=b=]
+
+#-----| [RegExpCharacterClass] [[=a=]]
+#-----| 0 -> [RegExpPosixEquivalenceClass] [=a=]
+
+#-----| [RegExpCharacterClass] [A-F[[.b.]]
+#-----| 0 -> [RegExpCharacterRange] A-F
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] [
+#-----| 2 -> [RegExpPosixCollatingSymbol] [.b.]
+
+#-----| [RegExpCharacterClass] [[.a.]]
+#-----| 0 -> [RegExpPosixCollatingSymbol] [.a.]
+
+#-----| [RegExpCharacterClass] [A-F[:digit:]a-f]
+#-----| 0 -> [RegExpCharacterRange] A-F
+
+#-----| [RegExpCharacterClass] [[:alpha:][:digit:]]
+
+#-----| [RegExpCharacterClass] [[:alpha:]]
+
+#-----| [RegExpCharacterClass] [[:digit:]]
+
+#-----| [RegExpCharacterClass] [[a-f]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] [
+#-----| 1 -> [RegExpCharacterRange] a-f
+
+#-----| [RegExpCharacterClass] [\b]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \b
+
+#-----| [RegExpCharacterClass] [|]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] |
+
+#-----| [RegExpCharacterClass] [^-]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] -
+
+#-----| [RegExpCharacterClass] [^]]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] ]
+
+#-----| [RegExpCharacterClass] []]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] ]
+
+#-----| [RegExpCharacterClass] [^A-Z]
+#-----| 0 -> [RegExpCharacterRange] A-Z
+
+#-----| [RegExpCharacterClass] [123]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] 1
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] 2
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] 3
+
+#-----| [RegExpCharacterClass] [\w]
+#-----| 0 -> [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpCharacterClass] [a-fA-F0-9_]
+#-----| 0 -> [RegExpCharacterRange] a-f
+#-----| 1 -> [RegExpCharacterRange] A-F
+#-----| 2 -> [RegExpCharacterRange] 0-9
+#-----| 3 -> [RegExpConstant, RegExpNormalChar] _
+
+#-----| [RegExpCharacterClass] [abc]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#-----| [RegExpAlt] a|b|cd
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] cd
+
+#-----| [RegExpAlt] o|b
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] o
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpAlt] foo|bar
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] foo
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] bar
+
+#-----| [RegExpQuantifier] d{2,3}?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] d
+
+#-----| [RegExpOpt] c??
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] c
+
+#-----| [RegExpPlus] b+?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpStar] a*?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpPlus] a+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpPlus] b+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpPlus] :+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] :
+
+#-----| [RegExpStar] (foo)*
+#-----| 0 -> [RegExpGroup] (foo)
+
+#-----| [RegExpPlus] \w+
+#-----| 0 -> [RegExpCharacterClassEscape] \w
+
+#-----| [RegExpStar] .*
+#-----| 0 -> [RegExpDot] .
+
+#-----| [RegExpStar] .*
+#-----| 0 -> [RegExpDot] .
+
+#-----| [RegExpPlus] [\w]+
+#-----| 0 -> [RegExpCharacterClass] [\w]
+
+#-----| [RegExpRange] a{7}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [InfiniteRepetitionQuantifier, RegExpRange] a{3,}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpRange] a{,8}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpRange] a{4,8}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpStar] a*
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#-----| [RegExpPlus] b+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#-----| [RegExpOpt] c?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] c
diff --git a/cpp/ql/test/library-tests/regex/parse.ql b/cpp/ql/test/library-tests/regex/parse.ql
new file mode 100644
index 000000000000..2e9debf3784a
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/parse.ql
@@ -0,0 +1,32 @@
+/**
+ * @kind graph
+ */
+
+import semmle.code.cpp.regex.internal.ParseRegExp
+import semmle.code.cpp.regex.RegexTreeView
+
+// Stop gap for missing flow configs
+class RegExpTest extends RegExp {
+  RegExpTest() { any() }
+}
+
+query predicate nodes(RegExpTerm n, string attr, string val) {
+  attr = "semmle.label" and
+  val = "[" + concat(n.getAPrimaryQlClass(), ", ") + "] " + n.toString()
+  or
+  attr = "semmle.order" and
+  val =
+    any(int i |
+      n =
+        rank[i](RegExpTerm t, string fp, int sl, int sc, int el, int ec |
+          t.hasLocationInfo(fp, sl, sc, el, ec)
+        |
+          t order by fp, sl, sc, el, ec, t.toString()
+        )
+    ).toString()
+}
+
+query predicate edges(RegExpTerm pred, RegExpTerm succ, string attr, string val) {
+  attr in ["semmle.label", "semmle.order"] and
+  val = any(int i | succ = pred.getChild(i)).toString()
+}
diff --git a/cpp/ql/test/library-tests/regex/regexp.cpp b/cpp/ql/test/library-tests/regex/regexp.cpp
new file mode 100644
index 000000000000..a1e1acb11c5a
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.cpp
@@ -0,0 +1,115 @@
+// semmle-extractor-options: -std=c++17
+
+namespace std {
+  template <class CharT>
+  class basic_regex {
+  public:
+    basic_regex(const CharT *s) {}
+    basic_regex(const CharT *s, int flags) {}
+    basic_regex &assign(const CharT *s) { return *this; }
+  };
+  typedef basic_regex<char> regex;
+} // namespace std
+
+// Empty
+std::regex r_empty("");
+
+// Basic sequence
+std::regex r_abc("abc");
+
+// Repetition
+std::regex r_rep1("a*b+c?d");
+std::regex r_rep2("a{4,8}");
+std::regex r_rep3("a{,8}");
+std::regex r_rep4("a{3,}");
+std::regex r_rep5("a{7}");
+
+// Alternation
+std::regex r_alt("foo|bar");
+
+// Character classes
+std::regex r_cc1("[abc]");
+std::regex r_cc2("[a-fA-F0-9_]");
+std::regex r_cc4("[\\w]+");
+std::regex r_cc5("\\[\\][123]");
+std::regex r_cc6("[^A-Z]");
+std::regex r_cc7("[]]");   // MRI gives a warning, but accepts this as matching ']'
+std::regex r_cc8("[^]]"); // MRI gives a warning, but accepts this as matching anything except ']'
+std::regex r_cc9("[^-]");
+std::regex r_cc10("[|]");
+std::regex r_cc11("[\\b]");
+
+// Nested character classes (BAD - not parsed correctly)
+std::regex r_nested("[[a-f]A-F]");
+
+// Meta-character classes
+std::regex r_meta1(".*");
+std::regex r_meta1m(".*"); // /.*/m mode variant — mode flags are constructor args in C++
+std::regex r_meta2("\\w+\\W");
+std::regex r_meta3("\\s\\S");
+std::regex r_meta4("\\d\\D");
+std::regex r_meta6("\\n\\r\\t");
+
+// Anchors
+std::regex r_anc2("\\b!a\\B");
+
+// Groups
+std::regex r_grp1("(foo)*bar");
+std::regex r_grp2("fo(o|b)ar");
+std::regex r_grp3("(a|b|cd)e");
+std::regex r_grp4("(?::+)\\w"); // Non-capturing group matching colons
+
+// Backreferences
+std::regex r_bref1("(a+)b+\\1");
+
+// Two separate character classes, each containing a single POSIX bracket expression
+std::regex r_posix1("[[:alpha:]][[:digit:]]");
+
+// A single character class containing two POSIX bracket expressions
+std::regex r_posix2("[[:alpha:][:digit:]]");
+
+// A single character class containing two ranges and one POSIX bracket expression
+std::regex r_posix3("[A-F[:digit:]a-f]");
+
+// POSIX collating symbols
+std::regex r_posix_coll1("[[.a.]]");
+std::regex r_posix_coll2("[A-F[[.b.]]a-f]");
+
+// POSIX equivalence classes
+std::regex r_posix_equiv1("[[=a=]]");
+std::regex r_posix_equiv2("[A-F[[=b=]]a-f]");
+
+// *Not* a POSIX bracket expression; just a regular character class.
+std::regex r_posix4("[:digit:]");
+
+// unicode
+std::regex r_uni("\\u0061");
+
+// control escapes
+std::regex r_ctrl1("\\cA");
+std::regex r_ctrl2("[\\cZ]");
+
+// NUL escape
+std::regex r_nul1("\\0");
+std::regex r_nul2("[\\0]");
+
+// Lazy quantifiers and additional supported escapes
+std::regex r_lazy1("a*?");
+std::regex r_lazy2("b+?");
+std::regex r_lazy3("c??");
+std::regex r_lazy4("d{2,3}?");
+std::regex r_fv("\\f\\v");
+
+// String literal spellings for location tests
+std::regex r_loc_plain("a\\nb");
+std::basic_regex<wchar_t> r_loc_L(L"abc");
+std::basic_regex<char> r_loc_u8(u8"abc");
+std::basic_regex<char16_t> r_loc_u(u"abc");
+std::basic_regex<char32_t> r_loc_U(U"abc");
+std::regex r_loc_R(R"(abc)");
+std::basic_regex<wchar_t> r_loc_LR(LR"(abc)");
+std::basic_regex<char> r_loc_u8R(u8R"(abc)");
+std::basic_regex<char16_t> r_loc_uR(uR"(abc)");
+std::basic_regex<char32_t> r_loc_UR(UR"(abc)");
+std::regex r_loc_Rx(R"x(abc)x");
+std::regex r_loc_Rfoo(R"foo(abc)foo");
diff --git a/cpp/ql/test/library-tests/regex/regexp.expected b/cpp/ql/test/library-tests/regex/regexp.expected
new file mode 100644
index 000000000000..a56d54663162
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.expected
@@ -0,0 +1,290 @@
+groupName
+groupNumber
+| file://:0:0:0:0 | (a+) | 1 |
+| file://:0:0:0:0 | (a\|b\|cd) | 1 |
+| file://:0:0:0:0 | (foo) | 1 |
+| file://:0:0:0:0 | (o\|b) | 1 |
+term
+| file://:0:0:0:0 | 0 | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | 0-9 | RegExpCharacterRange |
+| file://:0:0:0:0 | 1 | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | 2 | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | 3 | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | 9 | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | !a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | (?::+) | RegExpGroup |
+| file://:0:0:0:0 | (?::+)\\w | RegExpSequence |
+| file://:0:0:0:0 | (a+) | RegExpGroup |
+| file://:0:0:0:0 | (a+)b+\\1 | RegExpSequence |
+| file://:0:0:0:0 | (a\|b\|cd) | RegExpGroup |
+| file://:0:0:0:0 | (a\|b\|cd)e | RegExpSequence |
+| file://:0:0:0:0 | (foo) | RegExpGroup |
+| file://:0:0:0:0 | (foo)* | RegExpStar |
+| file://:0:0:0:0 | (foo)*bar | RegExpSequence |
+| file://:0:0:0:0 | (o\|b) | RegExpGroup |
+| file://:0:0:0:0 | - | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | . | RegExpDot |
+| file://:0:0:0:0 | . | RegExpDot |
+| file://:0:0:0:0 | .* | RegExpStar |
+| file://:0:0:0:0 | .* | RegExpStar |
+| file://:0:0:0:0 | : | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | :+ | RegExpPlus |
+| file://:0:0:0:0 | A | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A-F | RegExpCharacterRange |
+| file://:0:0:0:0 | A-F | RegExpCharacterRange |
+| file://:0:0:0:0 | A-F | RegExpCharacterRange |
+| file://:0:0:0:0 | A-F | RegExpCharacterRange |
+| file://:0:0:0:0 | A-F] | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | A-Z | RegExpCharacterRange |
+| file://:0:0:0:0 | F | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | F | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | F | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | F | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | Z | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | [ | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | [ | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | [ | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | [123] | RegExpCharacterClass |
+| file://:0:0:0:0 | [.a.] | RegExpPosixCollatingSymbol |
+| file://:0:0:0:0 | [.b.] | RegExpPosixCollatingSymbol |
+| file://:0:0:0:0 | [=a=] | RegExpPosixEquivalenceClass |
+| file://:0:0:0:0 | [=b=] | RegExpPosixEquivalenceClass |
+| file://:0:0:0:0 | [A-F[:digit:]a-f] | RegExpCharacterClass |
+| file://:0:0:0:0 | [A-F[[.b.]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [A-F[[.b.]]a-f] | RegExpSequence |
+| file://:0:0:0:0 | [A-F[[=b=]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [A-F[[=b=]]a-f] | RegExpSequence |
+| file://:0:0:0:0 | [[.a.]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[:alpha:][:digit:]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[:alpha:]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[:alpha:]][[:digit:]] | RegExpSequence |
+| file://:0:0:0:0 | [[:digit:]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[=a=]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[a-f] | RegExpCharacterClass |
+| file://:0:0:0:0 | [[a-f]A-F] | RegExpSequence |
+| file://:0:0:0:0 | [\\0] | RegExpCharacterClass |
+| file://:0:0:0:0 | [\\b] | RegExpCharacterClass |
+| file://:0:0:0:0 | [\\cZ] | RegExpCharacterClass |
+| file://:0:0:0:0 | [\\w] | RegExpCharacterClass |
+| file://:0:0:0:0 | [\\w]+ | RegExpPlus |
+| file://:0:0:0:0 | [\|] | RegExpCharacterClass |
+| file://:0:0:0:0 | []] | RegExpCharacterClass |
+| file://:0:0:0:0 | [^-] | RegExpCharacterClass |
+| file://:0:0:0:0 | [^A-Z] | RegExpCharacterClass |
+| file://:0:0:0:0 | [^]] | RegExpCharacterClass |
+| file://:0:0:0:0 | [a-fA-F0-9_] | RegExpCharacterClass |
+| file://:0:0:0:0 | [abc] | RegExpCharacterClass |
+| file://:0:0:0:0 | \\0 | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\0 | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\1 | RegExpBackRef |
+| file://:0:0:0:0 | \\B | RegExpNonWordBoundary |
+| file://:0:0:0:0 | \\D | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\S | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\W | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\[ | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\[\\][123] | RegExpSequence |
+| file://:0:0:0:0 | \\] | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\b | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\b | RegExpSpecialChar |
+| file://:0:0:0:0 | \\b!a\\B | RegExpSequence |
+| file://:0:0:0:0 | \\cA | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\cZ | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\d | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\d\\D | RegExpSequence |
+| file://:0:0:0:0 | \\f | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\f\\v | RegExpSequence |
+| file://:0:0:0:0 | \\n | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\n | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\n\\r\\t | RegExpSequence |
+| file://:0:0:0:0 | \\r | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\s | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\s\\S | RegExpSequence |
+| file://:0:0:0:0 | \\t | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\u0061 | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\v | RegExpConstant,RegExpEscape |
+| file://:0:0:0:0 | \\w | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\w | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\w | RegExpCharacterClassEscape |
+| file://:0:0:0:0 | \\w+ | RegExpPlus |
+| file://:0:0:0:0 | \\w+\\W | RegExpSequence |
+| file://:0:0:0:0 | \| | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | ] | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | ] | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | _ | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a* | RegExpStar |
+| file://:0:0:0:0 | a*? | RegExpStar |
+| file://:0:0:0:0 | a*b+c?d | RegExpSequence |
+| file://:0:0:0:0 | a+ | RegExpPlus |
+| file://:0:0:0:0 | a-f | RegExpCharacterRange |
+| file://:0:0:0:0 | a-f | RegExpCharacterRange |
+| file://:0:0:0:0 | a-f | RegExpCharacterRange |
+| file://:0:0:0:0 | a-f] | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a-f] | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a\\nb | RegExpSequence |
+| file://:0:0:0:0 | a\|b\|cd | RegExpAlt |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | abc | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | ar | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | a{3,} | InfiniteRepetitionQuantifier,RegExpRange |
+| file://:0:0:0:0 | a{4,8} | RegExpRange |
+| file://:0:0:0:0 | a{7} | RegExpRange |
+| file://:0:0:0:0 | a{,8} | RegExpRange |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | b+ | RegExpPlus |
+| file://:0:0:0:0 | b+ | RegExpPlus |
+| file://:0:0:0:0 | b+? | RegExpPlus |
+| file://:0:0:0:0 | bar | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | bar | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | c | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | c | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | c | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | c? | RegExpOpt |
+| file://:0:0:0:0 | c?? | RegExpOpt |
+| file://:0:0:0:0 | cd | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | d | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | d | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | d{2,3}? | RegExpQuantifier |
+| file://:0:0:0:0 | e | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | f | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | f | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | f | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | fo | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | fo(o\|b)ar | RegExpSequence |
+| file://:0:0:0:0 | foo | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | foo | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | foo\|bar | RegExpAlt |
+| file://:0:0:0:0 | o | RegExpConstant,RegExpNormalChar |
+| file://:0:0:0:0 | o\|b | RegExpAlt |
+regExpNormalCharValue
+| file://:0:0:0:0 | 0 | 0 |
+| file://:0:0:0:0 | 1 | 1 |
+| file://:0:0:0:0 | 2 | 2 |
+| file://:0:0:0:0 | 3 | 3 |
+| file://:0:0:0:0 | 9 | 9 |
+| file://:0:0:0:0 | !a | !a |
+| file://:0:0:0:0 | - | - |
+| file://:0:0:0:0 | : | : |
+| file://:0:0:0:0 | A | A |
+| file://:0:0:0:0 | A | A |
+| file://:0:0:0:0 | A | A |
+| file://:0:0:0:0 | A | A |
+| file://:0:0:0:0 | A | A |
+| file://:0:0:0:0 | A-F] | A-F] |
+| file://:0:0:0:0 | F | F |
+| file://:0:0:0:0 | F | F |
+| file://:0:0:0:0 | F | F |
+| file://:0:0:0:0 | F | F |
+| file://:0:0:0:0 | Z | Z |
+| file://:0:0:0:0 | [ | [ |
+| file://:0:0:0:0 | [ | [ |
+| file://:0:0:0:0 | [ | [ |
+| file://:0:0:0:0 | \\0 | 0 |
+| file://:0:0:0:0 | \\0 | 0 |
+| file://:0:0:0:0 | \\D | D |
+| file://:0:0:0:0 | \\S | S |
+| file://:0:0:0:0 | \\W | W |
+| file://:0:0:0:0 | \\[ | [ |
+| file://:0:0:0:0 | \\] | ] |
+| file://:0:0:0:0 | \\b | b |
+| file://:0:0:0:0 | \\cA | cA |
+| file://:0:0:0:0 | \\cZ | cZ |
+| file://:0:0:0:0 | \\d | d |
+| file://:0:0:0:0 | \\f | \u000c |
+| file://:0:0:0:0 | \\n | \n |
+| file://:0:0:0:0 | \\n | \n |
+| file://:0:0:0:0 | \\r | \r |
+| file://:0:0:0:0 | \\s | s |
+| file://:0:0:0:0 | \\t | \t |
+| file://:0:0:0:0 | \\u0061 | a |
+| file://:0:0:0:0 | \\v | \u000b |
+| file://:0:0:0:0 | \\w | w |
+| file://:0:0:0:0 | \\w | w |
+| file://:0:0:0:0 | \\w | w |
+| file://:0:0:0:0 | \| | \| |
+| file://:0:0:0:0 | ] | ] |
+| file://:0:0:0:0 | ] | ] |
+| file://:0:0:0:0 | _ | _ |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a | a |
+| file://:0:0:0:0 | a-f] | a-f] |
+| file://:0:0:0:0 | a-f] | a-f] |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | abc | abc |
+| file://:0:0:0:0 | ar | ar |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | b | b |
+| file://:0:0:0:0 | bar | bar |
+| file://:0:0:0:0 | bar | bar |
+| file://:0:0:0:0 | c | c |
+| file://:0:0:0:0 | c | c |
+| file://:0:0:0:0 | c | c |
+| file://:0:0:0:0 | cd | cd |
+| file://:0:0:0:0 | d | d |
+| file://:0:0:0:0 | d | d |
+| file://:0:0:0:0 | e | e |
+| file://:0:0:0:0 | f | f |
+| file://:0:0:0:0 | f | f |
+| file://:0:0:0:0 | f | f |
+| file://:0:0:0:0 | fo | fo |
+| file://:0:0:0:0 | foo | foo |
+| file://:0:0:0:0 | foo | foo |
+| file://:0:0:0:0 | o | o |
diff --git a/cpp/ql/test/library-tests/regex/regexp.ql b/cpp/ql/test/library-tests/regex/regexp.ql
new file mode 100644
index 000000000000..a29717199e24
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.ql
@@ -0,0 +1,17 @@
+import semmle.code.cpp.regex.internal.ParseRegExp
+import semmle.code.cpp.regex.RegexTreeView
+
+// Stop gap for missing flow configs
+class RegExpTest extends RegExp {
+  RegExpTest() { any() }
+}
+
+query predicate groupName(RegExpGroup g, string name) { name = g.getName() }
+
+query predicate groupNumber(RegExpGroup g, int number) { number = g.getNumber() }
+
+query predicate term(RegExpTerm term, string c) { c = term.getPrimaryQlClasses() }
+
+query predicate regExpNormalCharValue(RegExpNormalChar term, string value) {
+  value = term.getValue()
+}