Trying to make sense of npm audit results - node.js

Question

Background
If I do npm audit on a ReactJS application we haven't touched in a year (until recently), I get the following summary:
found 356 vulnerabilities (321 low, 20 moderate, 14 high, 1 critical)
in 11345 scanned packages run `npm audit fix` to fix 3 of them.
353 vulnerabilities require semver-major dependency updates.
If I do that npm audit fix those 3 vulnerabilities are resolved, the others are not because they are breaking changes.
Doing another npm audit I get this summary:
found 71 vulnerabilities (36 low, 20 moderate, 14 high, 1 critical) in 11345 scanned packages
71 vulnerabilities require semver-major dependency updates.
At the top of the audit:
Run npm install react-scripts#2.1.2 to resolve 71 vulnerabilities SEMVER WARNING: Recommended action is a potentially breaking change
After I do that npm install react-scripts#2.1.2 the vulnerabilities are reduced to only 1:
=== npm audit security report ===
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
High Missing Origin Validation
Package webpack-dev-server
Patched in >=3.1.11
Dependency of react-scripts
Path react-scripts > webpack-dev-server
More info https://nodesecurity.io/advisories/725
After I do a npm install webpack-dev-server#3.1.14, I get 2 new issues:
=== npm audit security report ===
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
High Missing Origin Validation
Package webpack-dev-server
Patched in >=3.1.11
Dependency of react-scripts
Path react-scripts > webpack-dev-server
More info https://nodesecurity.io/advisories/725
High Missing Origin Validation
Package webpack-dev-server
Patched in >=3.1.11
Dependency of webpack-dev-server
Path webpack-dev-server
More info https://nodesecurity.io/advisories/725
That more info link suggests an update to version 3.1.6 or later. What I do is way higher than that ...
Questions
To have a better understanding of what npm audit does, I'd like to discuss the following remarks:
Why does doing npm install webpack-dev-server#3.1.14 add an issue, rather than fix the one mentioned before? Looks like the previous issue remains even ...
Why does the vulnerabilities count drop from 356 to 71 after fixing only 3 issues while the total packages count is the same?
Why did the audit not suggest me to do npm install webpack-dev-server#3.1.11 or higher if it knows the issue is patched since 3.1.11? it did know npm install react-scripts#2.1.2 was necessary earlier.
What should I do to fix the issue mentioned in question #1?
PS: That nodesecurity link suggests to update webpack-dev-server to version 3.1.6 or higher. I'm doing much higher than that ...
PPS: I tried npm install webpack-dev-server#3.1.11 as well, no difference.

Answer 1

The advisory page for the webpack-dev-server vulnerability listed the latest version as an affected version. This has been caused by a typo in the npm security repository, as reported in a thread in the npm community forum. The typo has been fixed a few hours later.