Ljharb Traverse vulnerabilities

• ljharb traverse traverse: set() can write to built-in prototypes via an untrusted path CVE-2026-107353 Fix available 6.9 MediumOctober 7, 2026