* SECURITY UPDATE: HTTP/2 denial of service via rapid stream reset (HTTP/2 Rapid Reset) - debian/patches/CVE-2023-44487.patch: limit new streams to 2 * http2_max_concurrent_streams per event loop iteration in ngx_http_v2_state_headers, and cap refused streams at the maximum of http2_max_concurrent_streams and 100, so a client that opens and immediately cancels streams can no longer pin worker CPU - CVE-2023-44487 * SECURITY UPDATE: buffer overrun in the script engine via map directives using regex matching with a string expression - debian/patches/CVE-2026-42533.patch: add an e->end bound and an ngx_http_script_check_length() guard to the script copy code paths in both the http and stream script engines, and thread a separate header/parameter length accumulator through the proxy (headers_len, body_len), grpc (headers_len), fastcgi, scgi and uwsgi (params_len) upstream request builders, the http and stream access log writers, and the index, try_files and rewrite modules, so an attacker-controlled map+regex expansion can no longer overrun the assembled request, log or result buffer. Also drops uninitialised trailing bytes from complex values, which previously leaked to the client. - CVE-2026-42533 * SECURITY UPDATE: use-after-free via duplicate subrequest finalization in ngx_http_ssi_filter_module - debian/patches/CVE-2026-56434.patch: skip posting a request that is already on r->main->posted_requests in ngx_http_post_request, and reset r->write_event_handler to the empty handler during active subrequest finalization, so a subrequest posted twice can no longer be finalized twice and over-decrement r->main->count - CVE-2026-56434 * SECURITY UPDATE: uninitialized memory read via stale regex captures - debian/patches/CVE-2026-60005.patch: reset r->ncaptures when ngx_http_regex_exec reallocates r->captures, so a subsequent unnamed capture reference after a non-matching regex no longer reads uninitialized memory - CVE-2026-60005 * The CVE-2026-42533 patch additionally carries two upstream commits that are not part of the vulnerability fix but are required for it not to regress this package: - e09c0d32d51c reserves NGX_OFF_T_LEN rather than NGX_SIZE_T_LEN for the access log "request_length" variable, whose handler formats with %O. Without it the new length guard rejects every log line containing $request_length on 32-bit architectures (armel here), where off_t is 8 bytes and size_t is 4. - 4b90ec769235 restores the stack push in ngx_http_script_complex_value_code and has the new end code update that slot instead. Without it any module reusing ngx_http_script_complex_value_code without emitting the new end code -- which includes the ngx_devel_kit copy in debian/modules/http-ndk, and hence libnginx-mod-http-ndk and libnginx-mod-http-lua -- pops a stack slot that was never pushed. * Note for out-of-tree dynamic modules: the CVE-2023-44487 patch inserts two fields into ngx_http_v2_connection_t and the CVE-2026-42533 patch inserts one into ngx_http_script_engine_t, which shifts the offsets of later members in both. nginx_version and NGX_MODULE_SIGNATURE do not encode struct layout, so such a module loads without complaint. Every libnginx-mod-* package in this source package is rebuilt here and is unaffected; dynamic modules built elsewhere against 1.18.0-6.1+deb11u8 headers must be rebuilt.