* SECURITY UPDATE: HTTP/2 header blocks handed to JS stop being charged against maxSessionMemory while they can still be kept alive, letting a remote peer exhaust memory with many stalled streams carrying large header blocks (CVE-2026-56846) - debian/patches/CVE-2026-56846.patch: add a second per-stream counter Http2Stream::retained_headers_length_ in src/node_http2.h, move current_headers_length_ into it in Http2Session::HandleHeadersFrame() instead of calling DecrementCurrentSessionMemory() there, and drain both counters from the session total in Http2Session::RemoveStream() so the header memory is un-charged only once the stream is gone; also adds the upstream regression test test/parallel/test-http2-max-session-memory-stalled-headers.js, adapted in two ways: the header block is built as an object with a multi-valued cookie field because Http2Session#request() rejects upstream's flat header array, and the server is created with maxHeaderListPairs raised to 4096 so AddHeader()'s pair-count branch cannot be what the test measures, leaving the session-memory branch as the only route - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 heap use-after-free when RST_STREAM is submitted for a refused stream from inside an nghttp2 receive callback, which re-enters nghttp2's send path and frees streams the active receive is still using (CVE-2026-56848) - debian/patches/CVE-2026-56848.patch: in Http2Stream::SubmitRstStream() (src/node_http2.cc), defer the reset when Http2Session::is_in_scope() and the code is NGHTTP2_REFUSED_STREAM by calling FlushRstStream() and returning, instead of falling through to the SendPendingData() force purge; also adds the upstream regression test test/parallel/test-http2-rst-stream-reentrancy.js - CVE-2026-56848