diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index ceb770ab336646..e21cc69effffa3 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -27,6 +27,7 @@ const {
   ObjectSetPrototypeOf,
   ReflectApply,
   RegExp,
+  RegExpEscape,
   Symbol,
   SymbolFor,
 } = primordials;
@@ -110,6 +111,8 @@ const kPskIdentityHint = Symbol('pskidentityhint');
 const kPendingSession = Symbol('pendingSession');
 const kIsVerified = Symbol('verified');
 
+const kRegExpEscapedStar = RegExpEscape('*');
+
 const noop = () => {};
 
 let tlsTracingWarned = false;
@@ -1541,11 +1544,7 @@ Server.prototype.addContext = function(servername, context) {
     throw new ERR_TLS_REQUIRED_SERVER_NAME();
   }
 
-  const re = new RegExp(`^${
-    servername
-      .replace(/([.^$+?\-\\[\]{}])/g, '\\$1')
-      .replaceAll('*', '[^.]*')
-  }$`);
+  const re = new RegExp(`^${RegExpEscape(servername).replaceAll(kRegExpEscapedStar, '[^.]+')}$`);
 
   const secureContext =
     context instanceof common.SecureContext ? context : tls.createSecureContext(context);