JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases (CVE-2026-53550) | HOL Guard CVE