high2026-11-02 CVE-2026-62374-SD JWT JS: Tampered disclosures silently dropped instead of rejected GHSA-f9j6-8p6x-r9j6