- CVE-2026-123828: http2: fix a one-byte heap overflow when writing an ALTSVC frame; v8::String::WriteOneByte appends a NUL past the end of a MaybeStackBuffer sized exactly to the origin length - CVE-2026-123862: zlib: do not assert when params() is called on a stream that was destroyed while the deferred flush was still queued - CVE-2026-123863: http2: release header blocks retained by streams that were removed from a session, so the nghttp2 memory is freed before the session (also guards the session destructor's Detach() loop, which aborts on this release line because streams_ holds raw pointers rather than BaseObjectPtr) - CVE-2026-123864: tls, http: do not re-enter the HTTP parser from an empty TLS write; a zero-length write inside a read cycle could run the parser recursively and abort the process - CVE-2026-123865: http2: do not keep abandoned streams alive after the peer sends GOAWAY with NO_ERROR - CVE-2026-123866: http2: retain outbound buffers for the lifetime of the write rather than the stream - CVE-2026-123867: tls: apply a SNI context's CA certificates even when that context carries no certificate of its own, so server.addContext(host, { ca }) is honoured for client certificate verification - CVE-2026-123868: http2: charge inbound DATA frames to the session memory limit so a peer cannot grow retention with frame count alone - CVE-2026-123872: tls: bind sessions to the server name they were authenticated for, pin the name from the first ClientHello so renegotiation and HelloRetryRequest cannot change it, and refuse resumption for a peer-verifying server with no session id context of its own - CVE-2026-123874: http2: retain streams for the lifetime of their writes - CVE-2026-123877: https: key the Agent on the full per-request TLS policy, including sigalgs, privateKeyIdentifier and privateKeyEngine, so requests with distinct trust or identity policies cannot share a pooled socket or a cached TLS session