* SECURITY UPDATE: http2 client Out-of-Memory via unbounded ORIGIN frames (CVE-2026-48619) — a malicious HTTP/2 server can send an unlimited number of ORIGIN frames to a node:http2 client, appending origins to the session originSet with no bound - debian/patches/CVE-2026-48619.patch: backport of upstream c79968e108 (first in v22.23.0), caps the client-side originSet (default 128, configurable via options.maxOriginSetSize) and destroys the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded (Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present) - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostname authority rebinding (CVE-2026-48930) — dns.lookup/dnsPromises.lookup and net.connect accepted hostnames with an embedded NUL byte, silently truncated by the NUL-terminated C resolver, so a validated hostname could resolve a different authority - debian/patches/CVE-2026-48930.patch: backport of upstream 7dafafa242 (first in v22.23.0), adds validateStringWithoutNullBytes() and rejects embedded NUL bytes in the hostname / options.host arguments before they reach the C resolver - CVE-2026-48930 * SECURITY UPDATE: WebCrypto AES cipher output-length integer overflow (CVE-2026-48933) — AES_Cipher() computed the output buffer length as a signed int, so an input length near 2 GiB overflowed and aborted the process - debian/patches/CVE-2026-48933.patch: backport of upstream 98fbc89211 (first in v22.23.0), adds the TryGetIntCipherOutputLength() guard in crypto_cipher.h and uses it in AES_Cipher() so oversized inputs fail cleanly instead of overflowing - CVE-2026-48933