First of all, fix the pattern: - in between two chars inside a character class forms a range. So, the email part of your regex should be [-\w+.%]+@[\w-.]+\.[A-Za-z]{2,4} (note the position of - in the first character class, in the second, it is OK to put it between a shorthand character class \w and the next char).
Next, to match 1 to 5 comma-separated emails, you need to match the first one, and then match 0 to 4 emails. And add anchors around the pattern to make sure the pattern matches the whole string:
^[-\w+.%]+@[\w-.]+\.[A-Za-z]{2,4}(?:,[-\w+.%]+@[\w-.]+\.[A-Za-z]{2,4}){0,4}$
Basically, ^<EMAIL>(?:,<EMAIL>){0,4}$:
^ - start of string
<EMAIL> - an email pattern of yours
(?: - start of a non-capturing group acting as a container for a sequence of patterns:
, - a comma
<EMAIL> - an email pattern of yours
){0,4} - zero to four occurrences of these sequences above
$ - end of string.
Another idea is to split with , and then validate:
var s = "abc@gg.com,abc2@gg.com,abc3@gg.com,abc4@gg.com,abc5@gg.com";
var re = /^[-\w+.%]+@[\w-.]+\.[A-Za-z]{2,4}$/;
var items = s.split(",");
if (items.length <= 5 && items.filter(function(x) { return re.test(x); }).length === items.length ) {
console.log("VALID => ", items);
} else {
console.log("INVALID!");
}