* SECURITY UPDATE: keep-alive response-queue desynchronisation -- the CVE-2026-48931 data guard is driven by libuv's read callback, so bytes that reach the socket's receive buffer after the last event-loop poll are invisible to it and a reused free socket can answer the next request with a response written before that request was sent (CVE-2026-105481) - debian/patches/CVE-2026-105481.patch: add LibuvStreamWrap::HasPendingRead(), a MSG_PEEK|MSG_DONTWAIT probe exposed to JavaScript as hasPendingRead(), and check it in Agent.addRequest() before a socket is taken from the free pool * SECURITY UPDATE: dns.resolve truncates names containing a NUL character, because the resolver bindings validated the hostname only with validateString() and c-ares then took it as a NUL-terminated C string (CVE-2026-105482) - debian/patches/CVE-2026-105482.patch: validate every resolve input of both the callback and the promises API with validateStringWithoutNullBytes() * SECURITY UPDATE: TLS certificate hostname bypass -- net.isIP() answers 0 for every non-canonical spelling of an IP address, so fullwidth digits, octal, hexadecimal, decimal and short-form IPv4 literals were routed to the DNS-name branch of checkServerIdentity() and matched against DNS SANs (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072) - debian/patches/CVE-2026-105483.patch: reject non-canonical IP addresses in server identity checks * SECURITY UPDATE: Permission Model filesystem over-grant via wildcard radix lookup -- NextNode() bounded the prefix walk by the length of the queried path, so a path shorter than the child's prefix matched on a proper prefix alone and the wildcard shortcut then granted it (CVE-2026-106071) - debian/patches/CVE-2026-106071.patch: bound the walk by the prefix length * SECURITY UPDATE: Permission Model bypass with fs.realpathSync(), the one realpath implementation that walks the path through the unchecked bindings rather than the checked public wrappers (CVE-2026-106073) - debian/patches/CVE-2026-106073.patch: check kFileSystemRead in realpathSync() * SECURITY UPDATE: crypto.randomUUID() and crypto.randomInt() entropy caches are captured in user-land startup snapshots and single executable applications, so every process launched from one replays the same values (CVE-2026-106074) - debian/patches/CVE-2026-106074.patch: reset both caches across snapshot serialisation and deserialisation * SECURITY UPDATE: the Brotli decoder returned BROTLI_FALSE for a block switch in a meta-block that declared NBLTYPES=1, violating the BROTLI_SAFE contract that BROTLI_FALSE means short input -- the unsafe path discarded it into a tight infinite loop and the safe path into a permanent NEEDS_MORE_INPUT, so any decode of attacker-supplied Brotli, including a Content-Encoding: br response body, hangs the process (CVE-2026-111497) - debian/patches/CVE-2026-111497.patch: cherry-pick google/brotli 0ed4268a4401 so the condition is reported as a format error, and expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH