* SECURITY UPDATE: source address spoofing over HTTP/3, where a client that migrated to a new address had that address assigned to newly created QUIC streams before the address was validated, allowing an attacker to bypass authorization or rate limiting - debian/patches/CVE-2026-40460.patch: assign the connection path only once the path is validated, and drop the assignment from the backup path restore branch in src/event/quic/ngx_event_quic_migration.c - CVE-2026-40460 * SECURITY UPDATE: heap buffer overflow when proxying to a gRPC upstream, where ngx_http_grpc_create_request() reserved a fixed NGX_HTTP_V2_INT_OCTETS prefix for each HPACK field length without bounding the length of the field itself - debian/patches/CVE-2026-42055.patch: reject the request when the method, URI, host, or any header name or value exceeds NGX_HTTP_V2_MAX_FIELD in src/http/modules/ngx_http_grpc_module.c - only the gRPC half of the upstream fix applies here; the HTTP/2 proxy module does not exist in nginx 1.26, where proxy_http_version accepts only 1.0 and 1.1 - CVE-2026-42055 * SECURITY UPDATE: use-after-free during subrequest finalization, where a subrequest that was posted twice could be finalized twice and decrement r->main->count once too often, reachable through the SSI filter during unbuffered proxying - debian/patches/CVE-2026-56434.patch: skip posting a request that is already on the posted_requests list, and reset r->write_event_handler to the no-op handler while an active subrequest is being finalized in src/http/ngx_http_request.c - CVE-2026-56434 * SECURITY UPDATE: uninitialized memory read via stale regex captures, where ngx_http_regex_exec() reallocated r->captures without resetting r->ncaptures when the regex did not match, so a later unnamed capture read past the initialized part of the array - debian/patches/CVE-2026-60005.patch: reset r->ncaptures together with r->realloc_captures in src/http/ngx_http_variables.c - CVE-2026-60005