chore(security): address CVE-2026-12590 (#4262)