js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals (CVE-2026-49293) | HOL Guard CVE