- Add TLSSocket default error handler (CVE‑2025‑59465) and route TLS callback exceptions through error handlers (CVE‑2026‑21637).
- Disable futimes under the permission model, require full read/write permissions for symlink APIs, and refactor unsafe buffer creation to remove zero‑fill toggle (CVE‑2025‑55130, 55131, 55132).
- Rethrow stack‑overflow exceptions in async hooks to avoid silent failures (CVE‑2025‑59466).