Comment by qwm

These issues tend to happen way more in languages that depend on a runtime, especially one with dynamic lookup capabilities. If I remember correctly, log4shell depended on dynamic class loading and a lot of runtime-dependent stuff. Languages that are statically-compiled and memory-safe (namely Go and Rust) don't have the runtime vector and don't generally have the memory safety vectors either. I feel a lot safer deploying services written in Go than JS, for example.