Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ (CVE-2026-54335) | HOL Guard CVE