* SECURITY UPDATE: HTTP/2 header blocks retained by open streams escape the maxSessionMemory accounting - debian/patches/CVE-2026-56846.patch: keep a decoded HTTP/2 header block charged against maxSessionMemory while the JS objects built from it can still keep it alive. A new Http2Stream::retained_headers_length_ accumulates what Http2Session::HandleHeadersFrame() used to un-charge the moment it handed the headers up to JS, and Http2Session::RemoveStream() drains both counters when the stream leaves the session. A peer that opens many streams with large header blocks and never lets them complete can therefore no longer hold unbounded header memory alive while the credit-based limit reads as near zero. Node 12's RemoveStream() takes the stream as a parameter rather than looking it up by id, and its now-redundant un-charge in Http2Stream::~Http2Stream() is removed so the counter is not decremented twice (backport of nodejs/node f14d78b9e0) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 use-after-free via re-entrant RST_STREAM for a refused stream - debian/patches/CVE-2026-56848.patch: stop Http2Stream::SubmitRstStream() from force-purging the session's pending outbound data for a refused stream. Resetting a stream that nghttp2 refused after a GOAWAY happens from inside a receive callback, where session_->SendPendingData() re-enters nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still on the stack and can close and free streams the active receive operation is still using. Such a reset now goes out through FlushRstStream() alone, extending to NGHTTP2_REFUSED_STREAM the deferral that already covered NGHTTP2_CANCEL (backport of nodejs/node daa6d25e3d) - CVE-2026-56848