Security fixes are released for the latest version of pace-js. See Releases for the current version.

Please don't report security problems in public issues. Report them privately instead: report a vulnerability.

Include the pace-js version, a proof of concept, and what an attacker could do. You'll get a reply in the private report. Once a fix is released, a security advisory is published that credits you, unless you'd rather not be named.