Commit

I'll help you @tom - (AI assisted summary). The braces CVE saga is a clash between security researchers and maintainer Jon Schlinkert. Researchers identified a stack-exhaustion DoS triggered by deeply nested patterns, but Schlinkert considers the CVE essentially bogus, arguing that applications shouldn’t pass untrusted input into braces. On that basis, he has resisted merging proposed fixes, leaving downstream developers stuck with a high-severity advisory and no patched release. My take: even if the CVE’s real-world severity is debatable, refusing a relatively straightforward defensive fix because you disagree with the classification is poor ecosystem stewardship. A patch protects users regardless of whether the CVE deserves its severity rating.