Add cve id CVE-2026-89425 for #1698 in release notes

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -19,7 +19,7 @@ a pure JSON library.
 #1649: Optimize `NumberInput.looksLikeValidNumber` [CVE-2026-89407]
  (fix by @cowtowncoder, w/ Claude code)
 #1698: `UTF8DataInputJsonParser` does not honor `maxErrorTokenLength`
-  when reporting an unrecognized token
+  when reporting an unrecognized token [CVE-2026-89425]
  (fix by @pjfanning)
 
 2.18.10 (15-Aug-2026)