* SECURITY UPDATE: buffer overflow during URI-to-path mapping after a rewrite in a location using alias - debian/patches/CVE-2026-15176.patch: reject URI-to-path mapping while r->uri_changed is set in src/http/ngx_http_core_module.c - CVE-2026-15176 * SECURITY UPDATE: buffer overflow in HTTP and stream script evaluation - debian/patches/CVE-2026-93479.patch: keep the script engine end pointer at the end of the result buffer rather than the reserved area in src/http/ngx_http_script.c and src/stream/ngx_stream_script.c - CVE-2026-93479 * SECURITY UPDATE: use-after-free when pending asynchronous operations overflow the request blocked counter - debian/patches/CVE-2026-97205.patch: cap pending operations and use synchronous paths or reject new operations before r->main->blocked can wrap in the HTTP copy filter, file cache, and upstream code - CVE-2026-97205 * Fix worker crashes in third-party modules that reuse the complex value script code, such as ngx_devel_kit based set-misc directives - debian/patches/CVE-2026-42533.patch: include the upstream follow-up that restores the stack update in ngx_http_script_complex_value_code() of src/http/ngx_http_script.c