* SECURITY UPDATE: buffer over-read in the mp4 module when a specially crafted mp4 file was served with the mp4 directive enabled, allowing a worker process crash or disclosure of adjacent heap memory - debian/patches/CVE-2024-7347.patch: reject unordered chunk numbers in the stsc atom and compute the sample count as a 64-bit product so the stsz atom update cannot walk past the end of the sample table, in ngx_http_mp4_read_stsc_atom() and ngx_http_mp4_update_stsz_atom() of src/http/modules/ngx_http_mp4_module.c - CVE-2024-7347 * SECURITY UPDATE: disclosure of worker process memory in the mail proxy, where the SASL handlers stored the destination buffer in s->login and s->passwd before ngx_decode_base64() had validated the client supplied base64, so a malformed AUTH argument left those fields pointing at a partially written buffer that was then forwarded to the authentication server and written to the log - debian/patches/CVE-2025-53859.patch: decode into local variables and assign s->login and s->passwd only after ngx_decode_base64() returns NGX_OK, in ngx_mail_auth_plain(), ngx_mail_auth_login_username(), ngx_mail_auth_login_password() and ngx_mail_auth_cram_md5() of src/mail/ngx_mail_handler.c - CVE-2025-53859 * SECURITY UPDATE: missing length validation when building HTTP/2 and gRPC request and response header frames, where a header value longer than the HPACK field limit was written with a size prefix that could not represent it, corrupting the header block - debian/patches/CVE-2026-42055.patch: reject Content-Type and Location values above NGX_HTTP_V2_MAX_FIELD in ngx_http_v2_header_filter() of src/http/v2/ngx_http_v2_filter_module.c, and add the same guard to the five header emitting sites of ngx_http_grpc_create_request() in src/http/modules/ngx_http_grpc_module.c - the ngx_http_proxy_v2_module hunks of upstream commit 26d824ec3 are omitted because that module was added in 1.29.4 and does not exist in 1.21.6 - CVE-2026-42055 * SECURITY UPDATE: request posted twice to the posted requests queue during subrequest finalization, which linked the request to itself and left the worker process spinning in ngx_http_run_posted_requests() - debian/patches/CVE-2026-56434.patch: skip a request that is already on the queue in ngx_http_post_request(), and reset the write event handler after dropping the main request reference count in ngx_http_finalize_request(), in src/http/ngx_http_request.c - CVE-2026-56434 * SECURITY UPDATE: stale regular expression captures reused across a rewritten request, so a later successful match could read capture offsets left over from a previous regex with more capturing groups - debian/patches/CVE-2026-60005.patch: reset r->ncaptures together with r->realloc_captures in ngx_http_regex_exec() of src/http/ngx_http_variables.c - CVE-2026-60005