critical2026-11-10 CVE-2026-107846-bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list GHSA-8vv3-6qpc-gpw6