- CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a malicious server can no longer drive unbounded memory growth via repeated ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect() hostnames that contain an embedded NUL byte, preventing silent authority rebinding caused by C-string truncation in the resolver bindings; adds validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2) - CVE-2026-48933: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (len + block_size > INT_MAX), turning ~2 GiB one-shot cipher inputs into a clean failure instead of an out-of-bounds write; the legacy analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto)