A regex capture is a substring matched by a regular expression and stored for later use, usually as numbered groups like $1 or named variables. In security tools and server configurations, captures let operators reuse parts of a request, hostname, or path without parsing it again.
This flexibility matters because captures can become part of the attack surface. If a configuration combines regex captures with variable expansion in the wrong order, the software may read or write unexpected data, sometimes leading to crashes or memory corruption. Defenders should review regex-based rules carefully, especially in network-facing services, and test how captured values flow through later processing steps.