- Fixed multiple CVE‑related vulnerabilities including array index hash collisions, timing‑side‑channel issues in Web Crypto HMAC/KMAC, and unsafe header prototypes
- Added permission checks to lib/fs/promises and realpath.native to harden file‑system APIs
- Improved error handling for NGHTTP2 flow‑control errors and wrapped TLS SNICallback in try/catch