Fixes land on each project's latest release; there are no maintained back-branches.
Report it privately on the affected repository, and do not open a public issue.
You will receive acknowledgement within 48 hours, and a fix or mitigation plan within 7 days for confirmed vulnerabilities.