@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

{
                    "vendor": "node-oauth",
                    "product": "node-oauth2-server",
                    "versions": [
                        {
                            "version": "< 5.3.0",
                            "status": "affected"
                        }
                    ]
                }