axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions (CVE-2026-44490) | HOL Guard CVE