- CVE-2026-123865: detect streams abandoned by nghttp2 - CVE-2026-123828: avoid overflowing ALTSVC buffers - CVE-2026-123862: handle zlib params callback after destroy - CVE-2026-123863: release headers when a stream is removed - CVE-2026-123864: prevent nested parser execution from empty writes - CVE-2026-123867: apply the CA of SNI contexts without a certificate - CVE-2026-123866: retain buffers until socket writes finish - CVE-2026-123868: charge inbound DATA retained by streams to maxSessionMemory - CVE-2026-123877: isolate Agent TLS policy keys - CVE-2026-123872: do not allow resumption, renegotiation or HRR to change SNI - CVE-2026-123874: retain streams during pending writes