- CVE-2026-56846: keep HTTP/2 header blocks charged against maxSessionMemory while the JS objects built from them can still keep them alive. A new Http2Stream::retained_headers_length_ accumulates what Http2Session::HandleHeadersFrame() used to un-charge the moment it handed the headers up to JS, and Http2Session::RemoveStream() drains both counters when the stream leaves the session, so a peer can no longer hold unbounded header memory alive across many stalled streams while the credit-based limit reads as near zero (backport of nodejs/node f14d78b9e0). Node 12's RemoveStream() takes the stream as a parameter instead of looking it up by id, and its now-redundant un-charge in Http2Stream::~Http2Stream() is removed so the counter is not decremented twice - CVE-2026-56848: stop Http2Stream::SubmitRstStream() from force-purging the session's pending outbound data for a refused stream. Resetting a stream that nghttp2 refused after a GOAWAY happens from inside a receive callback, where session_->SendPendingData() re-enters nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still on the stack and can free streams the active receive is still using. Such a reset now goes out through FlushRstStream() alone, extending the deferral that already covered NGHTTP2_CANCEL to NGHTTP2_REFUSED_STREAM (backport of nodejs/node daa6d25e3d)