- CVE-2026-56846: HTTP/2 header blocks retained by JS escaped the maxSessionMemory budget. Backport upstream f14d78b9e020 (first in v22.23.2): Http2Session::HandleHeadersFrame() un-charged current_headers_length_ from the session total right after handing the decoded headers to JS, even though those objects can keep the block alive for the whole life of the stream, so a peer opening many streams with large header blocks and never completing them kept unbounded header memory reachable while currentSessionMemory read near zero and no stream was ever refused. Move the octets into a new per-stream counter retained_headers_length_ instead, and drain both counters in Http2Session::RemoveStream(). - CVE-2026-56848: HTTP/2 heap use-after-free via re-entrant RST_STREAM for a refused stream. Backport upstream daa6d25e3dce (first in v22.23.2): Http2Stream::SubmitRstStream() deferred the force purge of pending session data only for NGHTTP2_CANCEL, so for NGHTTP2_REFUSED_STREAM it called SendPendingData() -- and thus nghttp2_session_mem_send() -- while nghttp2_session_mem_recv() was still on the stack, letting the send path free streams the active receive was still using. Flush the RST_STREAM through nghttp2's normal queue and return instead when the session is in scope and the code is NGHTTP2_REFUSED_STREAM.