* SECURITY UPDATE: DNS hostname containing NUL bytes was truncated before being handed to c-ares, so a name could resolve as a shorter one - debian/patches/CVE-2026-105482.patch: validate the resolve*() name with validateStringWithoutNullBytes() in lib/dns.js and lib/internal/dns/promises.js. Resolver#setLocalAddress() does not exist on 12.x, so the upstream hunk for it is not applicable - CVE-2026-105482 * SECURITY UPDATE: non-canonical IPv4 host matched a certificate DNS SAN - debian/patches/CVE-2026-106069-CVE-2026-106072.patch: in tls.checkServerIdentity(), reject a host that is not an IP literal but becomes one after domainToASCII() normalization, such as 0127.0.0.1 or 127.1, instead of letting it fall through to DNS-name matching - CVE-2026-106069 - CVE-2026-106072 * SECURITY UPDATE: fullwidth digit IP host matched a certificate DNS SAN - debian/patches/CVE-2026-105483.patch: regression tests only; the code fix is in CVE-2026-106069-CVE-2026-106072.patch - CVE-2026-105483 * SECURITY UPDATE: out-of-bounds write in the bundled brotli decoder - debian/patches/CVE-2026-111497.patch: report an invalid block switch as BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH and stop decoding in deps/brotli/c/dec/decode.c instead of writing past the block type ring buffer - CVE-2026-111497 * SECURITY UPDATE: keep-alive socket was reused while a response written before the request was still unread in the OS buffer - debian/patches/CVE-2026-105481.patch: add hasPendingRead() to lib/_http_agent.js, backed by a new StreamBase binding in src/stream_wrap.cc, and destroy a free socket that already has data waiting instead of handing it to the next request - CVE-2026-105481