- Wrap SNICallback invocation in a try/catch to mitigate crashes (CVE‑2026‑21637).
- Use null‑prototype objects for headersDistinct/trailersDistinct and timing‑safe HMAC comparison, and add permission checks to realpath.native and fs/promises (CVE‑2026‑21710, ‑21713, ‑21715, ‑21716).
- Handle NGHTTP2 ERR_FLOW_CONTROL error code and address array index hash collision (CVE‑2026‑21714, ‑21717).