Only the latest release on nuget.org receives fixes. At the moment that is the 2.x line.

Report privately through GitHub security advisories. Do not open a public issue.

Include the code that triggers it, the platform and the package version. Expect a first reply within a week.