For the first URL the .* part of the pattern matches "site.com", but for the second URL it matches "site.com/hello-world".
If you don't want to allow more than one folder, you can disallow slash characters in the part of the pattern that matches the domain name:
^[^/]*/([a-z0-9,-]+)/([a-z0-9,-]+)\.html$
(Note that I put a backslash before the period before the html extension. A period matches any character, while \.
matches only a period.)
Edit:
If you want to allow both URLs and use "hello-world/test" as folder for the second one, allow slashes in the folder part:
^[^/]*/([a-z0-9,-/]+)/([a-z0-9,-]+)\.html$
If you want to use "hello-world" as folder and "test/test" as page, allow slashes in the file name part:
^[^/]*/([a-z0-9,-]+)/([a-z0-9,-/]+)\.html$