Only the latest published release line (currently 8.0.0-beta.x on the beta dist-tag, and 7.x on latest) receives security fixes.

Please do not open a public issue. Report it privately through GitHub Security Advisories. You should get a first answer within a week.