* SECURITY UPDATE: embedded-NUL hostnames -> silent authority rebinding - debian/patches/CVE-2026-48930.patch: reject hostnames containing an embedded NUL byte in dns.lookup(), dnsPromises.lookup() and net.connect()/net.createConnection() before they reach the C resolver, which would otherwise truncate the string at the NUL and resolve/connect to a different authority than the one validated in JavaScript. Adds validateStringWithoutNullBytes() in lib/internal/validators.js (backport of nodejs/node@7dafafa2 adapted to 14.21.3) - CVE-2026-48930 * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth - debian/patches/CVE-2026-48619.patch: cap the client-side originSet at a configurable maxOriginSetSize (default 128) in lib/internal/http2/core.js; a malicious server sending unlimited ORIGIN frames now trips ERR_HTTP2_TOO_MANY_ORIGINS instead of growing the set without bound (backport of nodejs/node@c79968e1) - CVE-2026-48619 * SECURITY UPDATE: cipher output-length signed-int overflow (~2 GiB input) - debian/patches/CVE-2026-48933.patch: guard the len + block_size output length computation in CipherBase::Update (src/node_crypto.cc) against signed-int overflow that produced a bogus buffer size passed to EVP_CipherUpdate() -> OOB write / crash. Node 14 predates WebCrypto, so the INT_MAX guard from nodejs/node@98fbc892 is adapted to the legacy crypto.createCipheriv().update() path - CVE-2026-48933