* SECURITY UPDATE: heap buffer overflow when a "rewrite" changed the URI in a location using "alias" and the URI was mapped to a path before a new location was selected, for example through $request_filename in "return", "set", "if", "add_header" or an access log format - debian/patches/CVE-2026-15176.patch: also reject URI to path mapping with "alias" when the r->uri_changed flag is set, in ngx_http_map_uri_to_path() of src/http/ngx_http_core_module.c - CVE-2026-15176 * SECURITY UPDATE: heap buffer overflow when a string expression with variables produced more data in the copy pass than the length pass predicted, for example map regex captures or non-cacheable variables in "root", "alias" or an "access_log" path, because the copy could spill into the caller's reserved area and the recalculated length then exceeded the allocated buffer - debian/patches/CVE-2026-93479.patch: exclude the reserved area from the copy bound and allocate it on top of the computed length, in ngx_http_script_run() of src/http/ngx_http_script.c and ngx_stream_script_run() of src/stream/ngx_stream_script.c - CVE-2026-93479 * SECURITY UPDATE: use-after-free when 256 or more asynchronous operations were pending on one request, for example AIO reads from many SSI "include virtual" subrequests, which wrapped the 8-bit r->main->blocked counter so the request could be freed while those operations still referenced its pool - debian/patches/CVE-2026-97205.patch: limit pending operations per request to NGX_HTTP_MAX_BLOCKED and perform further operations synchronously or refuse them, in ngx_http_copy_filter() of src/http/ngx_http_copy_filter_module.c, ngx_http_file_cache_lock() and ngx_http_file_cache_aio_read() of src/http/ngx_http_file_cache.c and ngx_http_upstream_thread_handler() of src/http/ngx_http_upstream.c, with the limit defined in src/http/ngx_http_request.h; also include the upstream fixes for request termination with AIO in subrequests (r->main->terminated, src/http/ngx_http_request.c) and for the use of closed upstream sockets with filter finalization (src/event/ngx_event_pipe.c), which the refusal path relies on - CVE-2026-97205 * Fix worker crashes in third-party modules that reuse the complex value script code, such as ngx_devel_kit based set-misc directives - debian/patches/CVE-2026-42533.patch: include the upstream follow-up that restores the stack update in ngx_http_script_complex_value_code() of src/http/ngx_http_script.c