* SECURITY UPDATE: DNS hostname with NUL bytes passed to c-ares truncated - debian/patches/CVE-2026-105482.patch: reject NUL bytes in dns resolve and setLocalAddress hostnames - CVE-2026-105482 * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: reject hosts such as 0127.0.0.1 or 127.1 in tls.checkServerIdentity - CVE-2026-106069 - CVE-2026-106072 * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN - debian/patches/CVE-2026-105483.patch: regression tests only, the code fix is in CVE-2026-106069-CVE-2026-106072.patch - CVE-2026-105483 * SECURITY UPDATE: keep-alive socket reused with pending response data - debian/patches/CVE-2026-105481.patch: peek free sockets with hasPendingRead() before reuse in lib/_http_agent.js - CVE-2026-105481 * SECURITY UPDATE: out-of-bounds write in bundled brotli decoder - debian/patches/CVE-2026-111497.patch: fail on an invalid block switch in deps/brotli/c/dec/decode.c - CVE-2026-111497 * SECURITY UPDATE: random caches replayed from a startup snapshot - debian/patches/CVE-2026-106074.patch: reset randomInt() and randomUUID() caches across --build-snapshot snapshots - CVE-2026-106074 * SECURITY UPDATE: permission wildcard grant matched shorter paths - debian/patches/CVE-2026-106071.patch: match only up to the wildcard prefix length in src/permission/fs_permission.h - CVE-2026-106071 * SECURITY UPDATE: fs.realpathSync() probed paths without fs.read - debian/patches/CVE-2026-106073.patch: check fs.read on the resolved path in realpathSync() in lib/fs.js - CVE-2026-106073