- CVE-2026-105481: http: check an idle keep-alive socket for unread bytes before handing it to a request, so a response written before the request was sent cannot be parsed as that request's response - CVE-2026-105482: dns: reject names containing NUL bytes in the resolve*() and reverse() paths instead of handing a truncated name to c-ares (Resolver#setLocalAddress does not exist on 10.x, so that half of the upstream change is not applicable here) - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes in lookup() and net.connect(); carried as a prerequisite of CVE-2026-105482, which calls the validateStringWithoutNullBytes() helper it adds - CVE-2026-48618: tls: normalize the peer hostname with domainToASCII() before matching it against the certificate's DNS names, so IDNA label separators such as U+3002 cannot defeat the wildcard-depth rule; carried as a prerequisite of CVE-2026-106069 and CVE-2026-105483, which fix bypasses of this normalization - CVE-2026-106069, CVE-2026-106072: tls: reject hosts that net.isIP() does not accept but that normalize to an IPv4 address, such as 0127.0.0.1, 0x7f.0.0.1 or 2130706433, so a certificate DNS SAN can no longer authenticate an IP endpoint - CVE-2026-105483: tls: cover the same bypass reached through IDNA mapping (fullwidth digits, ideographic full stop); the code fix is the CVE-2026-106069 patch, so this is a test-only change as it is upstream - CVE-2026-111497: deps: brotli: detect and report an invalid block switch earlier, fixing an out-of-bounds write in the decoder, and expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH - Not applicable to 10.24.1: CVE-2026-106070 (ZipFile), CVE-2026-106071 and CVE-2026-106073 (permission model), CVE-2026-106074 (startup snapshots/SEA)