go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth (CVE-2026-42328) | HOL Guard CVE