React Router vulnerable to Denial of Service via reflected user input in single-fetch (CVE-2026-34077) | HOL Guard CVE