* SECURITY UPDATE: HTTP/2 headers of a removed stream outlive their session -- RemoveStream() erased the stream without releasing current_headers_, and the session destructor loop can no longer see a removed stream, so a stream kept alive by a pending socket write outlived the session with nghttp2 rcbufs still referenced and tripped CHECK_EQ(current_nghttp2_memory_, 0) (CVE-2026-123863) - debian/patches/CVE-2026-123863.patch: call stream->ClearHeaders() in RemoveStream() immediately after streams_.erase(), before the accounting * SECURITY UPDATE: nested HTTP parser execution from empty writes -- the empty-write branch of TLSWrap::DoWrite() called ClearOut() unguarded, and Parser::Execute() reset current_buffer_* to null instead of restoring the caller's, with no bounds check on data callbacks (CVE-2026-123864) - debian/patches/CVE-2026-123864.patch: gate ClearOut() on cycle_depth_ == 0, save/restore the outer buffer, and reject out-of-buffer data with HPE_USER * SECURITY UPDATE: HTTP/2 streams abandoned by nghttp2 are never cleaned up -- a peer GOAWAY(NO_ERROR) sets graceful close first, so a later internal nghttp2 termination never set internal_goaway_sent_ and SendPendingData() never errored the still-open streams, hanging the stream and socket (CVE-2026-123865) - debian/patches/CVE-2026-123865.patch: add HasStreamsAbandonedByNghttp2() and consider it in SendPendingData() * SECURITY UPDATE: HTTP/2 write buffers released while the socket write is in flight -- OnSendData() pushed a partial slice holding no reference to the originating write request, and DoWrite() attached req_wrap to the last writev buffer only, so destroying a stream mid-write freed memory libuv was still reading and disclosed it across streams (CVE-2026-123866) - debian/patches/CVE-2026-123866.patch: add a non-completing buffer_owner reference to NgHttp2StreamWrite and propagate it to every slice * SECURITY UPDATE: HTTP/2 stream freed while writes are pending -- HasWritesOnSocketForStream() matched only entries carrying a req_wrap, which is set on the last writev entry only, so Http2Stream::Destroy() detached the stream while its DATA slices were still queued, a use-after-free reachable by cancelling a respondWithFile() download (CVE-2026-123874) - debian/patches/CVE-2026-123874.patch: retain the Http2Stream on every outgoing entry and test that reference instead of req_wrap * SECURITY UPDATE: TLS session resumption and renegotiation could change the SNI name -- sessions were never bound to the server name they were issued for, the SNI context was re-selected on every ClientHello so renegotiation or a TLS1.3 HelloRetryRequest could swap credentials mid-connection, and mutual TLS without a session id context allowed resumption to bypass client certificate verification (CVE-2026-123872) - debian/patches/CVE-2026-123872.patch: bind sessions to the server name, pin the name for the life of the connection, and disable resumption for mTLS with no session id context - NOTE: the server now always answers the servername callback with SSL_TLSEXT_ERR_OK, so an empty server_name extension is echoed by every TLS server on this build, and a renegotiation or HelloRetryRequest that changes or drops SNI is now rejected with illegal_parameter * SECURITY UPDATE: the CA of an SNI context without a certificate was ignored -- UseSNIContext() returns false for a certificate-less SecureContext, which short-circuited SetCACerts(), so a context added with server.addContext(host, {ca}) never installed its verify store or client CA list and clients for that host were verified against the default context's CA (CVE-2026-123867) - debian/patches/CVE-2026-123867.patch: track whether a context carries its own CA and apply it even when the context has no certificate * SECURITY UPDATE: inbound HTTP/2 DATA retained by undrained streams was not charged against maxSessionMemory, so a peer could make a session retain memory in proportion to the number of frames rather than the bytes sent (CVE-2026-123868) - debian/patches/CVE-2026-123868.patch: charge each retained chunk against maxSessionMemory, release it on resume or destroy, and stop reading from the socket while the session is over budget * SECURITY UPDATE: ALTSVC frame buffers overflowed by one byte -- the scratch buffers were sized at the exact string length while String::WriteOneByte() null-terminates by default, writing one byte past a heap allocation for origins or values longer than the 1024-byte stack buffer (CVE-2026-123828) - debian/patches/CVE-2026-123828.patch: pass an explicit length and String::NO_NULL_TERMINATION, as the sibling ORIGIN path already does * SECURITY UPDATE: null write request on a cancelled HTTP/2 stream -- ReportWritesToJSStreamListener::OnStreamAfterReqFinished() dereferenced the stream and the write request without checking either, and the synchronous write branch of StreamPipe passes a null request (CVE-2026-123875) - debian/patches/CVE-2026-123875.patch: return early when either is null * SECURITY UPDATE: https.Agent pooled sockets across different TLS trust policies -- getName() omitted secureContext, allowPartialTrustChain, ALPNProtocols, minDHSize, pskCallback, requestOCSP and session, so a socket negotiated under one trust policy could serve a request issued under another (CVE-2026-123877) - debian/patches/CVE-2026-123877.patch: include those options in the pool key * SECURITY UPDATE: recursive fs.watch() leaked the names of denied descendants -- FSEventWrap::OnEvent() passed the filename reported by libuv straight to JavaScript, the permission model being consulted only once when the watch was started (CVE-2026-123829) - debian/patches/CVE-2026-123829.patch: re-check kFileSystemRead for the reported path before delivering the event * SECURITY UPDATE: zlib params() callback after destroy -- paramsAfterFlushCallback() asserted on the native handle, so destroying a stream whose params() flush was still queued raised ERR_INTERNAL_ASSERTION from a write callback and aborted the process (CVE-2026-123862) - debian/patches/CVE-2026-123862.patch: propagate the write error to the user callback instead of touching the closed handle