* SECURITY UPDATE: HTTP/2 header blocks retained by JS evade maxSessionMemory (CVE-2026-56846) -- Http2Session::HandleHeadersFrame() un-charged the decoded header block from the session memory total as soon as it handed the headers to the JS layer, but those JS objects can keep the block alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete keeps unbounded header memory reachable while currentSessionMemory reads near zero and maxSessionMemory never refuses a stream - debian/patches/CVE-2026-56846.patch: backport of upstream f14d78b9e020 (first in v22.23.2), moving the octets into a new per-stream counter retained_headers_length_ instead of decrementing the session total, and draining both header counters in Http2Session::RemoveStream() so the accounting is released exactly when the stream goes away (Node 16 is EOL, no upstream 16.x fix) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 heap use-after-free via re-entrant RST_STREAM for a refused stream (CVE-2026-56848) -- Http2Stream::SubmitRstStream() deferred its force purge of pending session data only for NGHTTP2_CANCEL, so for a refused stream it called SendPendingData(), and hence nghttp2_session_mem_send(), while nghttp2_session_mem_recv() was still on the stack; the send path can then close and free streams the in-flight receive operation is still using - debian/patches/CVE-2026-56848.patch: backport of upstream daa6d25e3dce (first in v22.23.2), adding a second early return that calls FlushRstStream() and returns when the session is in scope and the code is NGHTTP2_REFUSED_STREAM, so the frame goes through nghttp2's normal queue instead of a re-entrant purge (Node 16 is EOL, no upstream 16.x fix) - CVE-2026-56848