chore(security): address CVE-2026-54753 (#4279)