diff --git a/lodash.js b/lodash.js
index 5db9358e72..fbf40eb3ef 100644
--- a/lodash.js
+++ b/lodash.js
@@ -277,7 +277,7 @@
   var reHasUnicode = RegExp('[' + rsZWJ + rsAstralRange  + rsComboRange + rsVarRange + ']');
 
   /** Used to detect strings that need a more robust regexp to match words. */
-  var reHasUnicodeWord = /[a-z][A-Z]|[A-Z]{2,}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/;
+  var reHasUnicodeWord = /[a-z][A-Z]|[A-Z]{2}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/;
 
   /** Used to assign default `context` object properties. */
   var contextProps = [
diff --git a/test/test.js b/test/test.js
index c62c4e84c5..841d30e766 100644
--- a/test/test.js
+++ b/test/test.js
@@ -25206,6 +25206,22 @@
 
       assert.deepEqual(actual, [['a'], ['b'], ['c']]);
     });
+
+    var maxMs = 5;
+    QUnit.test(`should take less than ${maxMs} ms to prevent ReDoS`, function(assert) {
+      assert.expect(3);
+
+      var hugeWordLen = 50000;
+      var hugeWord = 'A'.repeat(hugeWordLen);
+      var startTime = Date.now();
+      assert.deepEqual(_.words(hugeWord+'AeiouAreVowels'), [hugeWord, 'Aeiou', 'Are', 'Vowels']);
+      assert.deepEqual(_.words(hugeWord+'ÆiouAreVowels'), [hugeWord, 'Æiou', 'Are', 'Vowels']);
+      var endTime = Date.now();
+      var timeSpent = endTime - startTime;
+
+      assert.ok(timeSpent < maxMs, `operation took ${timeSpent} ms`);
+    });
+
   }());
 
   /*--------------------------------------------------------------------------*/