* SECURITY UPDATE: Permission Model bypass via process.report.writeReport() path misvalidation (CVE-2026-48617) - a process confined by --permission/--experimental-permission with --allow-fs-write could still write a diagnostic report outside the permitted set, because writeReport() consulted no permission gate - debian/patches/CVE-2026-48617.patch: gate writeReport() on permission.has('fs.write', file ?? process.cwd()) and throw ERR_ACCESS_DENIED on refusal (upstream 2f62693801, applies verbatim) - CVE-2026-48617 * SECURITY UPDATE: Unicode dot separator TLS wildcard-depth authentication bypass (CVE-2026-48618) - checkServerIdentity() split the hostname on the ASCII dot only, while the resolver applies IDNA mapping that also treats U+3002, U+FF0E and U+FF61 as label separators, so foobar.example.com connected as four labels but was verified as three and a *.example.com certificate authenticated a host two levels below it - debian/patches/CVE-2026-48618.patch: derive unfqdn(domainToASCII(hostname)) and feed it to splitHost() (upstream 2197a47144), plus the mandatory IPv6 IP-SAN follow-up 1d87a240505 without which IPv6 hosts stop matching their IP Address SANs - CVE-2026-48618 * SECURITY UPDATE: case-sensitive SNI context matching mTLS authorization bypass (CVE-2026-48928) - Server.prototype.addContext() compiled the servername into a RegExp with no flags, so an uppercase or mixed-case SNI name missed its per-hostname SecureContext and the handshake fell back to the default context, bypassing per-tenant client-CA/requestCert policy - debian/patches/CVE-2026-48928.patch: add the 'i' flag to that RegExp (upstream 39d1d09684) as RFC 6066 s3 requires - CVE-2026-48928 * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in http.Agent (CVE-2026-48931) - a keep-alive socket parked in the Agent freeSockets pool had the HTTPParser detached and no reader attached, so unsolicited bytes written by a hostile peer stayed queued and were parsed as the response to the next request that reused the socket; on 23.x the default http/https globalAgent is keepAlive:true, so no opt-in is required - debian/patches/CVE-2026-48931.patch: install a libuv-handle-level read guard on idle pooled sockets and destroy any socket that receives data while idle (upstream 0a22d40180 plus the mandatory follow-up eaa292549e, which moves the guard off the public 'data' listener that caused ERR_STREAM_PREMATURE_CLOSE regressions) - CVE-2026-48931 * SECURITY UPDATE: TLS host verification bypass via session reuse (CVE-2026-48934) - onConnectSecure() skips checkServerIdentity() when the session is reused, and a client session carried no record of the host it was authenticated for, so a session from host A could be replayed against host B and the connection reported authorized against an unchecked certificate - debian/patches/CVE-2026-48934.patch: wrap emitted/returned sessions with the authenticated servername and reject a session offered for a different host, and make getSession() a real method instead of a raw handle proxy (upstream fd890ba01d, with the regression tests from 1662a3ea09) - CVE-2026-48934 * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() (CVE-2026-48935) - FileHandle.prototype.utimes() -> futimes() in the fs/promises API carried no permission gate, so a process confined with --permission and only --allow-fs-read could still mutate a file's atime/mtime; this is the promises-API half left ungated by CVE-2025-55132 - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from futimes() when permission.isEnabled(), matching the existing fchmod() and fchown() guards in the same file (upstream a929332960) - CVE-2026-48935 * SECURITY UPDATE: HTTP/2 sessions never clean up after an nghttp2-internal GOAWAY (CVE-2026-48937) - when nghttp2 hits a protocol error before reading a frame payload (oversized frame header, padding error, HPACK failure) it calls nghttp2_session_terminate_session() directly, which queues a GOAWAY but invokes no callback, so Node emitted no 'error', never destroyed the Http2Session, never closed the socket and kept consuming everything the peer sent -> unauthenticated remote resource exhaustion - debian/patches/CVE-2026-48937.patch: add internal_goaway_sent_ / goaway_initiated_ flags, set the former in OnFrameSent() for a GOAWAY the application did not initiate and raise NGHTTP2_ERR_PROTO at the end of SendPendingData() (functional src/ hunks of upstream a1a5bb9683; the bundled nghttp2 is not bumped, so the two flow-control test re-baselines are omitted, and the !IsGracefulCloseInitiated() sub-condition is dropped as that accessor does not exist on this line) - CVE-2026-48937