It was discovered that default settings leave Prosody susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3. Lua 5.2 is the default and recommended Lua version for Prosody 0.11.x series.

The default configuration is susceptible to this issue.
Configurations with stricter settings for stanza size limits, rate limits and garbage collection parameters are at decreased risk from this attack. For more details please review the ‘Mitigation’ section for recommended values.

Reference:
https://prosody.im/security/advisory_20210512/