webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies (CVE-2026-9595) | HOL Guard CVE