- CVE-2023-39333: module: stop code injection through WebAssembly export names in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now uses index-derived local bindings and a JSONStringify-quoted import.meta.exports key instead of interpolating the attacker-controlled export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4 has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }` clause is emitted only for names matching the IdentifierName grammar) - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data while idle in the Agent freeSockets pool, closing the response-queue poisoning window left open once responseKeepAlive() detaches the parser and its 'data' listener (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which guards the idle socket at the handle level instead of attaching a public 'data' listener plus resume())