The technical severity is high and the fix is straightforward, which makes this a deployment problem rather than an engineering one.

Patch availability is not patch adoption. The median time-to-update for self-hosted deployments of comparable frameworks has historically run to several weeks, and a meaningful tail never updates at all. Organisations running managed platforms will have been patched automatically; organisations running their own infrastructure should treat this as same-day work.

Check your dependency tree rather than your direct dependencies, the affected package is most often pulled in transitively.