Find the installed version in the lockfile, then compare it with the affected versions in the official advisory. Check whether the vulnerable feature is actually used. Do not invent a severity score for your deployment.
Test the supported fixed version in a branch. Record the advisory link, compatibility changes and remaining uncertainty. This is a learning workflow, not a live CVE notice.