- CVE-2026-56846: keep HTTP/2 header blocks charged against maxSessionMemory for as long as JS can reach them. HandleHeadersFrame() now moves current_headers_length_ into a new Http2Stream::retained_headers_length_ counter instead of un-charging it from the session total the moment the headers are handed to JS, and RemoveStream() drains both counters when the stream leaves the session, so a peer can no longer keep unbounded header memory alive on stalled streams while maxSessionMemory reads as near zero - CVE-2026-56848: do not force purge pending session data from Http2Stream::SubmitRstStream() when RST_STREAM is submitted for a refused stream while nghttp2 is still inside a receive callback. Such a stream (a HEADERS frame arriving for an unknown stream on a closed session, e.g. right after a GOAWAY) is now answered with FlushRstStream() alone, so nghttp2_session_mem_send() is no longer re-entered from inside nghttp2_session_mem_recv() where it could free streams the active receive is still using