13 CVEs (6 CVEs on decoding) over five years is a moderate or good track record. Legacy format libraries like libjpeg, libpng, or libtiff have historically accumulated dozens or hundreds of CVEs even if they were built several years before the CVE process was started.

libjxl's vulnerability rate is low, but it still reflects the growing pains of a modern high-quality C/C++ parsing library.

With Rust things can be safer: For jxl-oxide there is one CVE. libjxl-rs does not yet have filed CVEs.