- CVE-2026-123828: http2: fix one-byte heap overflow in session.altsvc() - CVE-2026-123862: zlib: params() callback no longer asserts on a closed handle - CVE-2026-123877: https: Agent keys encode TLS options by type and length - CVE-2026-123875: http2: fix use of a freed WriteWrap when a respondWithFile() stream is cancelled - CVE-2026-123872: tls: pin the server name on renegotiation, bind session resumption to it, disable resumption for mTLS without a session id context - CVE-2026-123866: http2: keep write buffers until the socket write finishes - CVE-2026-123874: http2: keep a stream alive while its writes are on the socket - CVE-2026-123868: http2: charge inbound DATA held by paused streams to maxSessionMemory