- CVE-2026-105482: dns: reject hostnames with NUL bytes in resolve and setLocalAddress instead of passing a truncated name to c-ares - CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts such as 0127.0.0.1 or 127.1 so they cannot match a certificate DNS SAN - CVE-2026-105483: tls: add regression tests for fullwidth digit and ideographic dot IP hosts, the fix is the CVE-2026-106069 patch - CVE-2026-111497: brotli: stop the decoder on an invalid block switch instead of writing past the block type ring buffer - CVE-2026-105481: http: peek free keep-alive sockets for pending data before reuse and destroy them, even when no I/O poll has run - CVE-2026-106074: crypto: reset the randomInt() and randomUUID() caches when a startup snapshot is built, so snapshot processes do not replay them