- CVE-2026-105482: dns: reject hostnames containing NUL bytes in the resolve*() paths instead of handing a truncated name to c-ares (Resolver#setLocalAddress does not exist on 12.x, so that half of the upstream change is not applicable here) - CVE-2026-106069, CVE-2026-106072: tls: reject non-canonical IPv4 hosts such as 0127.0.0.1 or 127.1, which net.isIP() rejects but domainToASCII() normalizes into an address, so they could be matched against a certificate DNS SAN - CVE-2026-105483: tls: add regression tests for fullwidth digit and ideographic dot IP hosts; the code fix is the CVE-2026-106069 patch - CVE-2026-111497: brotli: stop the bundled decoder on an invalid block switch instead of writing past the block type ring buffer - CVE-2026-105481: http: check free keep-alive sockets for pending data before reuse and destroy them, even when no I/O poll has run