Security fixes are released for the latest major version.

Do not open a public issue for a suspected vulnerability. Send a private report to richardfariax@gmail.com with the affected version, reproduction steps, impact, and any proposed mitigation. Please allow a reasonable response period before public disclosure.