Only the latest release receives security fixes.

Do not open a public issue.

Use GitHub's private vulnerability reporting to submit a report.

You should receive an acknowledgment within 72 hours. A fix will be released as a patch version.