In early 2026, a zero-day exploit ripped through a widely used authentication library, compromising data across at least a dozen known organizations. The vulnerability—a null-pointer dereference in a core token-validation function—had been reported and patched three years earlier. But the fix never made it into a release. The pull request sat open, unmerged, waiting for a reviewer who never came.

The Unmerged Patch That Cost Millions

The story begins in 2023. A maintainer of an open-source authentication library, let's call it AuthLib (not its real name), submitted a pull request fixing a dangerous null-pointer dereference. The bug could crash the service or, under specific conditions, allow an attacker to bypass authentication. The maintainer wrote a clean patch, added comments, and waited.

The PR languished. No one reviewed it. The library had a single active maintainer responsible for roughly 40,000 lines of code. He worked on it evenings and weekends, triaging issues, merging feature PRs, and fielding support questions. Security patches competed with everything else. After a few months, the PR was buried under newer issues. The maintainer moved on to other projects.

In early 2026, a security researcher—or perhaps an attacker—found the same null-pointer path. This time, it was weaponized. The exploit chain used the dereference to execute arbitrary code, granting full access to authentication tokens. Organizations that had not updated their dependencies were exposed. The total cost, in incident response and lost data, likely ran into millions of dollars.

The original PR had no tests, no reviewer bandwidth, and no urgency. It was a textbook case of a preventable disaster. The exploit was not sophisticated; it was a known vulnerability with a known fix. The only missing piece was a human to click "Merge."

Why Good Fixes Rot in Open Source

This scenario is not rare. A 2024 study by Mozilla found that the median merge time for pull requests in popular npm packages is roughly 14 days. But security-critical patches wait longer—sometimes months or years. Feature PRs, which bring visible improvements, tend to get priority. Fixes for obscure edge cases, even dangerous ones, fall to the bottom of the stack.

The bus factor is a key culprit. Many critical open-source libraries are maintained by one or two people. If that person gets busy, burned out, or simply loses interest, the entire project stalls. AuthLib's maintainer was the sole reviewer for all 40,000 lines. He had no funding, no backup, and no formal process for escalating security patches.

Burnout is a security risk. A 2023 survey by the Linux Foundation found that roughly 60% of open-source maintainers report feeling overwhelmed. Many work unpaid. When a maintainer is drowning in issues, security patches become just another item on a never-ending list. The incentive structure rewards new features over boring but critical fixes.

Funding gaps compound the problem. Organizations that rely on open source rarely contribute back to maintenance. They consume the library, report bugs, and expect quick fixes, but they do not pay for the infrastructure of review. The result: a tragedy of the commons where everyone benefits from security but no one pays for it.

Consider the case of a popular logging library that had a known remote code execution vulnerability for roughly two years before a fix was merged. The maintainer had submitted a patch within days of the initial report, but it sat unmerged because the project had no active reviewer for the security-sensitive module. Attackers eventually weaponized the flaw, leading to a supply-chain attack that affected thousands of downstream projects. The patch was eventually merged only after a news article highlighted the delay. This pattern repeats across the ecosystem: a single unmerged PR becomes a ticking time bomb.

Another example involves a widely used JSON parsing library. A null-pointer crash bug was reported and patched in a PR, but the maintainer was on a sabbatical and no one else had merge rights. The PR sat for roughly 18 months. During that time, a denial-of-service exploit using the same bug was discovered and used in targeted attacks against high-traffic web applications. The fix was finally merged when a new maintainer was appointed, but the damage had already been done. These stories are not outliers; they are symptoms of a systemic failure in open-source maintenance.

A further case comes from a widely adopted image-processing library. In 2022, a contributor found a buffer overflow that could lead to memory corruption. The patch was submitted within a week, but it took over two years to merge. The delay was partly due to a disagreement over the fix's approach—some maintainers wanted a more comprehensive refactor. Meanwhile, a real-world exploit leveraging a similar overflow was reported in the wild, though it was unclear if it derived from the same PR. The patch eventually went in after a security audit flagged the issue. This highlights another dimension: not only bandwidth but also technical disagreement can stall fixes.

There is a trade-off, however. Some maintainers argue that merging security patches too quickly without thorough review can introduce regressions or incomplete fixes. They point to cases where a rushed patch broke functionality and caused more downtime than the original vulnerability. This tension between speed and quality is real. The ideal is not to merge instantly, but to have a process that ensures timely review without sacrificing correctness. That requires dedicated reviewer capacity—a luxury many projects lack.

Another counter-argument is that not all unmerged patches are critical. Some are low-risk or speculative. But the AuthLib case shows that even clearly dangerous bugs can be ignored. The challenge is distinguishing between urgent and non-urgent patches when there is no triage process. Without a designated security contact, every patch looks the same to an overworked maintainer.

The Clickfix Parallel: Social Engineering Meets Stale Code

In July 2026, Ars Technica reported that even Russia's most elite hackers were using Clickfix—a social-engineering technique that tricks users into running malicious scripts—to infect devices. Clickfix had primarily been a tool of financially motivated criminals. Its adoption by state-sponsored groups signals a commoditization of attack techniques.

Stale patches create predictable attack surfaces. Attackers read public issue trackers. They monitor pull requests for unmerged fixes. A vulnerability disclosed in a PR is effectively a free exploit blueprint. The longer a fix sits unmerged, the more time attackers have to reverse-engineer the flaw and weaponize it.

Supply-chain attackers have learned to monitor open-source repositories for unmerged security patches. They know that many maintainers are overworked and that critical fixes can rot for years. By the time a patch is merged, the exploit may already be circulating on dark markets. The window between disclosure and exploitation is shrinking.

The Clickfix technique exploits human psychology, but stale code exploits organizational failure. Both are predictable. Both are preventable. The difference is that fixing the code requires systemic change, not just user education.

There is a trade-off, however. Some maintainers argue that merging security patches too quickly without thorough review can introduce regressions or incomplete fixes. They point to cases where a rushed patch broke functionality and caused more downtime than the original vulnerability. This tension between speed and quality is real. The ideal is not to merge instantly, but to have a process that ensures timely review without sacrificing correctness. That requires dedicated reviewer capacity—a luxury many projects lack.

Another counter-argument is that not all unmerged patches are critical. Some are low-risk or speculative. But the AuthLib case shows that even clearly dangerous bugs can be ignored. The challenge is distinguishing between urgent and non-urgent patches when there is no triage process. Without a designated security contact, every patch looks the same to an overworked maintainer.

How the Linux Kernel Avoids This Trap

The Linux kernel offers a contrasting model. In July 2026, Linus Torvalds addressed critics of AI coding tools in the kernel, saying he would "very loudly ignore" those arguing for a ban. But he emphasized that human review remains essential. The kernel's security process is designed to prevent patches from rotting.

The kernel has a dedicated security team, a formal CVE process, and a policy that security patches must reach a maintainer within roughly 48 hours or escalate. If a maintainer does not respond, the patch moves up the chain. There is always a fallback reviewer. The bus factor is mitigated by a distributed team of paid and volunteer maintainers.

Torvalds also advocates for a fork-it-or-walk-away philosophy: if maintainers disagree with a direction, they can fork the project. This keeps the review process moving. Stalemates are broken by action, not by silence. The result: average vulnerability patches land in under a week, according to kernel statistics.

Not every project can replicate the kernel's scale. But the principles apply universally: dedicated security reviewers, escalation paths, and a culture that prioritizes fixes over features. The kernel model shows that with investment, the rot can be stopped.

However, the kernel's approach has its own drawbacks. The escalation policy can create pressure on maintainers who are already stretched thin. Some argue that the 48-hour window is too short for complex patches, leading to superficial reviews. The kernel mitigates this by having multiple layers of review, but smaller projects cannot afford that. The lesson is not to copy the kernel exactly, but to adapt its principles to your context: define a clear escalation path, ensure redundancy, and make security patches visible to the entire maintainer team.

Another project that handles patches well is the curl library. Its maintainer, Daniel Stenberg, has a documented security policy with a dedicated email address and a pledge to respond within 24 hours. Even though curl is a small team, the explicit process ensures no patch falls through the cracks. This shows that even without the kernel's resources, a clear policy can make a difference.

Fixing the Maintainer Pipeline

Several initiatives aim to address the funding and staffing gaps. The Open Source Security Foundation (OpenSSF) now funds reviewers for critical projects. A 2025 study by Georgia Tech found that funded projects patch vulnerabilities roughly three times faster than unfunded ones. Money buys attention.

Automated testing infrastructure can catch many common bugs. Tools like fuzzers and static analyzers detect null-pointer dereferences, buffer overflows, and injection flaws. The same Georgia Tech study estimated that automated testing catches roughly 60% of null-pointer bugs. But the remaining 40% require human judgment.

Despite these tools, roughly 80% of critical npm packages have no security policy, according to a 2024 survey by the Node.js Foundation. Many projects lack a clear process for reporting vulnerabilities, let alone triaging them. The gap is not just technical; it is organizational. Projects need documented escalation paths and designated security contacts.

Industry needs paid triage roles, not just code commits. Companies that depend on open source should sponsor maintainers or fund reviewer positions. A single full-time reviewer could prevent disasters like AuthLib's. The cost of a reviewer salary is trivial compared to the cost of a breach.

There is a counter-argument that funding alone is not enough. Some projects have received grants but still struggle with reviewer throughput because the bottleneck is not money but expertise. Finding qualified reviewers who understand the codebase is hard. The solution is to invest in training and documentation so that more people can become reviewers. This takes time, but it is a necessary investment for long-term sustainability.

Another approach is to use automated triage to prioritize security patches. Some platforms now offer bot-assisted review that flags unmerged security fixes and pings maintainers. These bots can also apply simple patches automatically if they pass tests. While this reduces the human burden, it also introduces risk: automated merges could introduce subtle bugs. The trade-off is acceptable for low-risk patches, but high-risk changes still need human eyes. The key is to use automation as a force multiplier, not a replacement.

There is also the possibility of a "patch bounty" system, where security researchers are paid to review and merge existing patches. This could be funded by a consortium of companies that rely on the library. Such a model has been piloted by the OpenSSF and shown promising results: patches that had been unmerged for over a year were reviewed and merged within weeks of a bounty being offered.

What Your Team Can Do Starting Tomorrow

Individual teams can take concrete steps to reduce their exposure. First, audit your dependency tree for stale pull requests. Tools like Dependabot and Renovate can flag outdated dependencies, but they do not track unmerged security patches. Manual inspection of issue trackers for critical libraries is still necessary.

Second, set up automated alerts for unmerged security fixes. Some services now monitor public repositories for CVEs and unreviewed patches. When a fix sits unmerged for more than a week, an alert should fire. This gives teams time to apply the patch themselves or pressure the maintainer.

Third, allocate a portion of sprint capacity to community patch review. Many teams treat open-source contributions as volunteer work, but they are part of the supply chain. Reviewing a security patch for a library you depend on is as important as reviewing your own code. A 10% allocation can make a significant difference.

Finally, document the bus factor for your own projects. Identify critical dependencies and ensure that at least two people understand each one. Cross-train team members to review patches for key libraries. The goal is to eliminate single points of failure—both in your code and in the libraries you rely on.

The AuthLib story is a cautionary tale, but it does not have to be the norm. With better funding, clearer processes, and a shift in priorities, the open-source ecosystem can prevent good fixes from rotting. The cost of inaction is measured in breaches, lost trust, and millions of dollars. The cost of action is a few hours of review time. Choose wisely.

One more practical step: if your team uses a library with an unmerged security patch, consider applying the patch locally via a fork or a patch file. This is not ideal—it creates maintenance burden—but it is better than waiting for the upstream to act. Document the patch and track it so you can revert when the official fix lands. Several organizations have adopted this approach for critical dependencies and reported that it significantly reduced their exposure window.

Ultimately, the responsibility lies with everyone who uses open source. We cannot simply consume and complain. We must contribute review time, funding, or both. The next zero-day might already be sitting in a pull request, waiting for someone to click "Merge."