CVE-2026-33939 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation