* SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the maxSessionMemory limit - debian/patches/CVE-2026-56846.patch: charge retained HTTP/2 header memory against the session budget. Http2Session::HandleHeadersFrame() used to call DecrementCurrentSessionMemory(stream->current_headers_length_) the moment the decoded header block was handed up to JS, even though the JS objects built from it can stay alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete (initialWindowSize 0, stalled responses) keeps unbounded header memory alive while current_session_memory_ reads as near zero, maxSessionMemory never trips and no stream is rejected with NGHTTP2_ENHANCE_YOUR_CALM. Http2Stream gains a second counter, retained_headers_length_; HandleHeadersFrame() moves current_headers_length_ into it instead of decrementing the session total, and Http2Session::RemoveStream() drains both counters before releasing the stream, so header blocks reachable from JS stay accounted for exactly as the maxSessionMemory option documents (no upstream Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from upstream f14d78b9e020, first in v22.23.2, whose v24.x sibling is 34ed88a06939 and whose main-branch landing is b7fd13a59a; the doc/api wording hunks are dropped) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 use-after-free when RST_STREAM for a refused stream re-enters nghttp2 from inside a receive callback - debian/patches/CVE-2026-56848.patch: defer the RST_STREAM purge while nghttp2 is in scope. Http2Stream::SubmitRstStream() force-purged pending session data through session_->SendPendingData() for every code except NGHTTP2_CANCEL, so a refused stream -- onSessionHeaders() answering a HEADERS frame for an unknown stream on an already-closed session with handle.rstStream(NGHTTP2_REFUSED_STREAM), reached from Http2Session::HandleHeadersFrame() inside OnFrameReceive() with nghttp2_session_mem_recv() still on the stack -- re-entered nghttp2_session_mem_send() inside the active receive operation, where the send path can close and free streams the receive is still using (heap-use-after-free; triggered remotely by HEADERS for fresh streams sent immediately after a GOAWAY with last_stream_id 0). SubmitRstStream() now treats NGHTTP2_REFUSED_STREAM while is_in_scope() like the existing cancel case: FlushRstStream() only, with the pending data written when the enclosing scope unwinds (no upstream Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from upstream daa6d25e3dce, first in v22.23.2, whose v24.x and v26.x siblings are a77c7f7354c9 and 23b94c843ae0; the cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried) - CVE-2026-56848