protobufjs: Memory amplification from preserved unknown fields in binary decode (CVE-2026-54270) | HOL Guard CVE