Fixes land on each project's latest release; there are no maintained back-branches.

Report it privately on the affected repository, and do not open a public issue.

You will receive acknowledgement within 48 hours, and a fix or mitigation plan within 7 days for confirmed vulnerabilities.