CVE-2016-9179 was published about Lynx in November 2016. Lynx took more than 5 minutes to release an update, with the fix included [1] in 2.8.9dev.11 not reaching a production release until July 2018 — almost two years after the CVE was published.

With a response time like that, I don't see how Lynx will satisfy their "5 minute fix" need any more than Firefox did.

[1] https://lynx.invisible-island.net/current/CHANGES