- CVE-2026-123863: http2: release the headers of a removed stream, by calling ClearHeaders() in RemoveStream() right after streams_.erase() -- the session destructor loop can no longer see a removed stream, so a stream kept alive by a pending socket write outlived its session with nghttp2 rcbufs still referenced and aborted on CHECK_EQ(current_nghttp2_memory_, 0) - CVE-2026-123864: tls,http: prevent nested parser execution from empty writes, by gating ClearOut() in the empty-write branch of TLSWrap::DoWrite() on cycle_depth_ == 0, restoring the caller's current_buffer_ in Parser::Execute() instead of nulling it, and rejecting out-of-buffer data callbacks with HPE_USER - CVE-2026-123865: http2: detect streams abandoned by nghttp2 -- a peer GOAWAY(NO_ERROR) set graceful close first, so a later internal nghttp2 termination never set internal_goaway_sent_ and SendPendingData() never errored the still-open streams, hanging the stream and the socket - CVE-2026-123866: http2: retain write buffers until the socket write finishes, by adding a non-completing buffer_owner reference to NgHttp2StreamWrite and propagating it to every partial slice -- OnSendData() previously held no reference, so destroying a stream mid-write freed memory libuv was still reading and disclosed it across streams - CVE-2026-123874: http2: retain streams during pending writes, by testing a retained Http2Stream reference in HasWritesOnSocketForStream() instead of req_wrap, which is attached to the last writev entry only -- Destroy() detached the stream while its DATA slices were still queued, a use-after-free reachable by cancelling a respondWithFile() download - CVE-2026-123872: tls: bind TLS sessions to the SNI name they were issued for, pin the server name for the life of the connection, and disable resumption for mutual TLS with no session id context -- resumption and renegotiation could otherwise change the SNI name, a HelloRetryRequest could swap credentials mid-connection, and mTLS resumption could bypass client certificate verification. Note the server now always answers the servername callback with SSL_TLSEXT_ERR_OK, so an empty server_name extension is echoed by every TLS server on this build, and a renegotiation or HelloRetryRequest that changes or drops SNI is now rejected with illegal_parameter - CVE-2026-123867: tls: apply the CA of an SNI context that carries no certificate -- UseSNIContext() returns false for a certificate-less SecureContext and short-circuited SetCACerts(), so a context added with server.addContext(host, {ca}) never installed its verify store or client CA list and clients for that host were verified against the default context's CA - CVE-2026-123868: http2: charge inbound DATA retained by undrained streams against maxSessionMemory and stop reading from the socket while the session is over budget -- a peer could otherwise make a session retain memory in proportion to the number of DATA frames rather than the bytes sent - CVE-2026-123828: http2: avoid overflowing the ALTSVC scratch buffers, which were sized at the exact string length while String::WriteOneByte() appends a NUL by default, writing one byte past a heap allocation for an origin or value longer than the 1024-byte stack buffer - CVE-2026-123875: http2: guard against a null write request on a cancelled stream -- OnStreamAfterReqFinished() dereferenced both the stream and the write request unchecked, and the synchronous write branch of StreamPipe passes null - CVE-2026-123877: https: isolate Agent TLS policy keys, by including secureContext, allowPartialTrustChain, ALPNProtocols, minDHSize, pskCallback, requestOCSP and session in the socket pool key -- a pooled socket negotiated under one trust policy could otherwise serve a request issued under another - CVE-2026-123829: permission: do not leak the names of denied descendants from recursive fs.watch(), by re-checking kFileSystemRead for the path libuv reports before delivering the event -- the permission model was consulted only once, when the watch was started - CVE-2026-123862: zlib: handle a params() callback that runs after destroy, by propagating the write error to the user callback instead of asserting on the closed native handle, which raised ERR_INTERNAL_ASSERTION from a write callback and aborted the process