- CVE-2026-56850: https: distinguish PFX object-array agent keys, so an https.Agent pool name built from a `pfx` array of { buf, passphrase } objects folds in each entry's certificate and passphrase instead of stringifying the array to the literal `[object Object]`, which made every such array share one pool entry and let a request reuse a keep-alive socket or a resumed TLS session authenticated with a different client certificate - CVE-2026-58042: dns: handle large resolveAny address replies, by sizing the A and AAAA TTL buffers from the reply's ANCOUNT instead of a fixed 256 entries, so a dns.resolveAny() answer carrying more than 256 A records no longer trips CHECK_EQ(naddrttls, a_count) and aborts the process - CVE-2026-58045: zlib: throw on out-of-bounds write buffers, so a TypedArray whose byteLength is spoofed with a getter makes the synchronous node:zlib entry points raise a catchable RangeError (ERR_OUT_OF_RANGE) instead of failing a CHECK in CompressionStream::Write() and aborting the process