- CVE-2026-93682: out-of-bounds read on an empty Location header in the http stream wrapper. An empty Location allocates a single byte for the NUL terminator, so the relative-redirect branch read location[1] past the end of the allocation and could append a garbage-derived path to the redirect target instead of the host root. The length is now taken from header_info.location_len and the relative join is skipped unless the Location is longer than one character, which also keeps a single-character Location resolving against the host root as before (GH-23467, GH-23521). - CVE-2026-91768: FPM compared only the first 96 bits of an IPv6 listen.allowed_clients entry. fcgi_is_allowed() passed a hard-coded 12 to memcmp(), so any client sharing the first 96 bits of an allowed IPv6 address was accepted. The full sizeof(struct in6_addr) is now compared (GHSA-62xp-839h-2637).