- CVE-2026-93682: out-of-bounds read when following a redirect with an empty Location header - the relative-redirect branch of the http stream wrapper tested location[1] on a buffer that holds only the NUL terminator, over-reading the heap and letting a garbage-derived path be appended to the redirect target; the length checks now use header_info.location_len (backport of upstream 8196275133edb830ec85330d36659d5b257b44db together with its follow-up de3436c76e460ca44829cc8234926280d96ceae6, which restores host-root resolution for a single-character Location) - CVE-2026-91768: FastCGI listen.allowed_clients matched only the first 96 bits of an IPv6 address - fcgi_is_allowed() passed a hard-coded length of 12 to memcmp(), so any client sharing the leading 12 bytes of an allowed address was accepted; the comparison now covers the full sin6_addr (backport of upstream dcdfcf86fcf7f42fa98dd3d000f310ebdad41965)