protobufjs: Denial of service through unbounded Any expansion during JSON conversion (CVE-2026-48712) | HOL Guard CVE