In 2021, Synapse experienced a critical vulnerability affecting all versions, leaving self-hosted instances that delayed updates in a high-risk exposed state for weeks after the fix was released.