* SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the maxSessionMemory limit - debian/patches/CVE-2026-56846.patch: keep the decoded header block charged against maxSessionMemory for as long as the stream can still reach it (src/node_http2.{cc,h}). HandleHeadersFrame() no longer un-charges current_headers_length_ the moment the block is handed to JS; it moves the amount into a new per-stream counter, Http2Stream::retained_headers_length_, and RemoveStream() drains both counters when the stream is erased. Without this, a peer that opens many streams with large header blocks and never lets them complete (for example with initialWindowSize 0) keeps unbounded header memory alive while the credit-based limit reads as near zero, so CanAddStream() never refuses a new stream and nghttp2 never answers NGHTTP2_ENHANCE_YOUR_CALM -- remote memory exhaustion (backport of nodejs/node@f14d78b9, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test with two deviations. The header block is built as an object with a multi-valued cookie field because 14.21.3's Http2Session#request() rejects the flat array upstream passes; that one is required, or the test throws ERR_INVALID_ARG_TYPE before it ever reaches the fix. The server also raises maxHeaderListPairs to 4096, which is hardening: it puts the pair-count branch of AddHeader() structurally out of reach, leaving the session-memory branch as the only thing the test can be measuring. The wire shape still matches upstream's -- 120 cookie fields plus four pseudo-headers, 124 entries. The three doc/api/http2.md hunks are deliberately omitted, so the -docs sub-package keeps describing maxSessionMemory without the "header blocks retained by open streams" clause) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 re-entrant RST_STREAM for refused streams -> heap use-after-free - debian/patches/CVE-2026-56848.patch: stop force-purging pending session data when a RST_STREAM is submitted for a refused stream from inside an nghttp2 callback scope (src/node_http2.cc). Http2Stream::SubmitRstStream() previously called session_->SendPendingData() for every code except NGHTTP2_CANCEL, re-entering nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on the stack, and the send path could close and free streams the active receive operation was still using. NGHTTP2_REFUSED_STREAM now takes the same deferred path: the reset is flushed with FlushRstStream() and the pending data is left for the enclosing Http2Scope to send. Reachable by sending GOAWAY with last_stream_id 0 immediately followed by HEADERS for further streams, which nghttp2 refuses from inside the same receive callback (backport of nodejs/node@daa6d25e, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test verbatim; upstream's cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried) - CVE-2026-56848