Fix a ReDoS in 'style' format #180
Being open is not a problem of the
I fixed that in a rewrite (along with a number of other issues). Docs on technical decisions and the reasoning behind the changes are still in progress, but switching to not failing open everywhere was the most significant reason.
That induced a mostly complete rewrite of the lib and it can't be fixed with minor changes, I believe. I'll document those things soonish.
That went via https://github.com/nodejs/security-wg and https://hackerone.com/nodejs-ecosystem.