Root has patched GHSA-g2v6-rqmx-r4w6 in the @vue/server-renderer package for Root:npm. Multiple fixed versions available.