* SECURITY UPDATE: NULL pointer dereference in ngx_mail_auth_http_module when a CRAM-MD5 or APOP authentication attempt is retried - debian/patches/CVE-2026-27651.patch: clear s->passwd with ngx_str_null() in ngx_mail_auth_http_create_request, so the stale length no longer survives into the next auth attempt and terminates the worker process - CVE-2026-27651 * SECURITY UPDATE: heap buffer overflow in ngx_http_dav_module on COPY and MOVE inside an aliased prefix location - debian/patches/CVE-2026-27654.patch: reject a Destination URI shorter than clcf->alias in ngx_http_dav_copy_move_handler, so the integer underflow in ngx_http_map_uri_to_path can no longer overwrite the heap or move files outside the location root - debian/patches/CVE-2026-27654-2.patch: also require the Destination URI to match the aliased location prefix, and add the corresponding check to ngx_http_map_uri_to_path - CVE-2026-27654 * SECURITY UPDATE: integer overflow in ngx_http_mp4_module on 32-bit platforms while validating atom entry counts - debian/patches/CVE-2026-27784.patch: widen the entries count to uint64_t in the stts, stss, ctts, stsc, stsz, stco and co64 atom size checks, so a crafted mp4 file can no longer cause reads and writes outside the allocated mp4 buffer - CVE-2026-27784