* SECURITY UPDATE: Heap buffer overflow when mapping a rewritten URI to a file path in a location with "alias" - debian/patches/CVE-2026-15176.patch: refuse the alias URI to path mapping once a rewrite has changed the URI, so a URI shorter than the location prefix can no longer underflow the path length - CVE-2026-15176 * SECURITY UPDATE: Heap buffer overflow in script evaluation when a value grows past the reserved area of the result buffer - debian/patches/CVE-2026-93479.patch: allocate the reserved tail separately from the evaluated value in ngx_http_script_run() and ngx_stream_script_run(), so the value copy cannot spill into it - CVE-2026-93479 * SECURITY UPDATE: Use-after-free from an overflow of the pending operations counter with SSI and asynchronous file I/O - debian/patches/CVE-2026-97205.patch: limit the number of pending operations per request by falling back to synchronous file reads, not waiting for cache locks and refusing upstream thread tasks once the counter reaches the limit; also include the upstream fixes for request termination with AIO in subrequests and for the use of closed upstream sockets with filter finalization, which the limit relies on - CVE-2026-97205 * Fix worker crashes in third-party modules that reuse the complex value script code, such as ngx_devel_kit based set-misc directives - debian/patches/CVE-2026-42533.patch: include the upstream follow-up that restores the stack update in ngx_http_script_complex_value_code()