- CVE-2026-56847: permission: enforce fs write permission for trace events, by resolving the configured --trace-event-file-pattern to the path the tracing agent will open and checking it against the FileSystemWrite grant before NodeCategorySet::Enable() starts the agent, so enabling trace events can no longer create or truncate a file the process was never allowed to write - CVE-2026-58039: permission: check the final report output path, by joining report.directory and the report filename into one pathname in TriggerNodeReport() and moving the FileSystemWrite check to just before the file is opened, and by prepending the configured directory to the resource the JavaScript gate tests, so process.report.writeReport() can no longer write a report into a directory outside the grant - CVE-2026-58044: http: reject requests exceeding the max header count, by counting header pairs in the C++ parser and failing the request with HPE_HEADER_OVERFLOW once it passes maxHeaderPairs, instead of letting llhttp honour headers that were then truncated out of the list JavaScript sees -- a divergence that let Content-Length or Transfer-Encoding headers frame a request the application could not observe