- CVE-2026-40701: fix resolver use-after-free in OCSP; the resolve context was leaked when a client SSL connection was terminated while resolving an OCSP responder, so completion of the resolve touched freed memory - CVE-2025-53859: fix buffer over-read in ngx_mail_smtp_module; login and password storage could be left in an inconsistent state after base64 decoding errors in the plain/login/cram-md5 auth methods - CVE-2026-28753: validate the host name resolved from the client address against the character set of RFC 1034 section 3.5, preventing CRLF injection into auth_http and smtp proxy requests - CVE-2026-42934: fix buffer over-read in ngx_http_charset_module recode_from_utf8(); pass the saved byte count rather than the last saved index to ngx_utf8_decode() and advance past the whole saved sequence on invalid UTF-8