- CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport upstream c79968e108 (first in v22.23.0): cap the client-side originSet (default 128, configurable via options.maxOriginSetSize on connect) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded. Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present. - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding. Backport upstream 7dafafa242 (first in v22.23.0): add validateStringWithoutNullBytes() and reject embedded NUL bytes in the hostname/options.host arguments of dns.lookup, dnsPromises.lookup and net.connect before they reach the NUL-terminated C resolver. - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow. Backport upstream 98fbc89211 (first in v22.23.0): add TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in AES_Cipher() so an input length near 2 GiB fails cleanly instead of overflowing the signed int buffer length and aborting the process.