> Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? I think it most definitely falls into "malicious code" tha

> Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? I think it most definitely falls into "malicious code" that certainly is not done in good faith, and if not handled properly by downstream users, can cause a lot of unexpected problematic failures. Whatever labels are used to characterize this, whether to call it a vulnerability/DoS or not, are just a matter of arguing over semantic meaning.