Only the latest 2.x minor release receives security fixes. Upgrade to it before reporting a problem that may already be fixed.

Report vulnerabilities privately through GitHub's Report a vulnerability form (private security advisories) on this repository. Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Include the package version, a minimal reproduction, and the expected and actual impact. You should receive an acknowledgement through the advisory thread.

Denial of service caused by inputs that exceed the documented budgets, such as the limits described in the API reference and the evasion and fuzzy matching guides, counts as a security issue. Report it privately like any other vulnerability.