HIGH7.5npmGHSA-737v-mqg7-c878· CVE-2026-35209defu: Prototype pollution via `__proto__` key in defaults argumentModified: 9/10/2026