- CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected - CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix - remove upstream test1701, which performs an HTTP/2 Upgrade on an HTTP/1.1 POST; nghttp2 1.43 no longer supports Upgrade requests carrying a body, so the test fails against the nghttpx in the build root