* SECURITY UPDATE: HTTP/2 client unbounded ORIGIN-frame memory growth - debian/patches/CVE-2026-48619.patch: cap the HTTP/2 client originSet at 128 entries (new maxOriginSetSize connect option) so a malicious server can no longer drive unbounded memory growth by sending repeated ORIGIN frames; the session is destroyed with the new ERR_HTTP2_TOO_MANY_ORIGINS error once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostname authority rebinding - debian/patches/CVE-2026-48930.patch: reject hostnames containing an embedded NUL byte in dns.lookup(), dnsPromises.lookup() and net.connect()/net.createConnection() by adding validateStringWithoutNullBytes, preventing silent authority rebinding caused by C-string truncation in the resolver bindings (backport of nodejs/node 7dafafa2) - CVE-2026-48930 * SECURITY UPDATE: cipher output-length signed integer overflow - debian/patches/CVE-2026-48933.patch: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (reject when len + block_size > INT_MAX), turning ~2 GiB one-shot crypto.createCipheriv().update() inputs into a clean failure instead of an out-of-bounds write; legacy-path analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto) - CVE-2026-48933