js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing (CVE-2026-59870) | HOL Guard CVE