* SECURITY UPDATE: HTTP/2 header blocks retained by open streams escape the maxSessionMemory budget, allowing remote memory exhaustion (CVE-2026-56846) - Http2Session::HandleHeadersFrame() moved the decoded header block into JS and then immediately called DecrementCurrentSessionMemory( stream->current_headers_length_), un-charging every octet from the session's accounting even though the JS objects it just handed out can stay reachable for the whole lifetime of the Http2Stream. Since Http2Session::AddStream() only rejects new streams once current_session_memory_ crosses max_session_memory_, a peer that opens many streams, sends a large header block on each, and never lets them complete (for example by advertising initialWindowSize 0) accumulates unbounded header memory while the session reports near zero, so maxSessionMemory gives no protection against the largest contributor to that memory and the process can be driven to OOM by an unauthenticated remote peer - debian/patches/CVE-2026-56846.patch: adds a new Http2Stream field retained_headers_length_ that accumulates the header octets instead of decrementing them, so they stay charged while they can still be alive; drains both current_headers_length_ and retained_headers_length_ in Http2Session::RemoveStream(), each guarded by > 0 and zeroed after, so header memory is released exactly when the stream that can reach it goes away. The src/ hunks are carried verbatim from upstream f14d78b9e020 (v22.23.2; equivalent to 34ed88a06939 in v24.18.1) and needed no adaptation for 23.11.1. The upstream regression test test/parallel/test-http2-max-session-memory-stalled-headers.js is also carried, but adapted, with two deliberate deviations: its header block is built as an object with a multi-valued cookie field, because Http2Session#request() rejects the flat array upstream passes and would throw before the fix was ever exercised; and the test server raises maxHeaderListPairs to 4096, so that the pair-count branch of Http2Stream::AddHeader() cannot be what the test ends up measuring. The upstream doc/api/http2.md wording update is deliberately not carried, so the -doc sub-package's maxSessionMemory description does not yet mention header blocks retained by open streams - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 re-entrant nghttp2 send during an active receive causes a heap use-after-free (CVE-2026-56848) - Http2Stream::SubmitRstStream() deferred the frame only for NGHTTP2_CANCEL when nghttp2 was already inside a callback. For every other code -- including NGHTTP2_REFUSED_STREAM, which Node submits for any stream opened after a GOAWAY has set last_stream_id below that stream's id -- it fell through to session_->SendPendingData(), driving nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on the stack. The send pass can close streams and free the nghttp2_stream and Http2Stream state the suspended receive still points into; when the receive resumes it dereferences freed memory. Reachable from a raw socket with SETTINGS, HEADERS on stream 1, then GOAWAY(last_stream_id=0) immediately followed by HEADERS for streams 3, 5 and 7, with no authentication and no application cooperation - debian/patches/CVE-2026-56848.patch: adds a second in-scope guard, right after the existing NGHTTP2_CANCEL one, that calls FlushRstStream() and returns for NGHTTP2_REFUSED_STREAM, so the RST_STREAM is only queued (and flushed when the outer scope unwinds) instead of forcing a purge that re-enters nghttp2. Also carries the upstream regression test test/parallel/test-http2-rst-stream-reentrancy.js verbatim (upstream daa6d25e3dce, v22.23.2; identical insertion in ba6cb5c34c22, a77c7f7354c9 and 23b94c843ae0 for main, v24.18.1 and v26.5.1; the commit's cosmetic re-indent of the pre-existing AddPendingRstStream block deliberately omitted) - CVE-2026-56848