Comment by wtarreau

Their maintainers have always be among the most responsive to security reports, so at least for this reason I wouldn't encourage you to switch to an alternate solution. The component might have historical problems but they're methodically being eliminated by rigorous people. If more software was maintained like this, we'd progressively converge towards bug-free code.