* SECURITY UPDATE: heap buffer overflow in nginx worker via map+regex capture variables in script engine - debian/patches/CVE-2026-42533.patch: backport upstream commits ea47fabf55e2 (Script: simplified copy capture codes), 7ac67898bdfe (Script: buffer overrun protection), 326b17b00383 (Script: buffer overrun protection in direct script usage), 78950bdcd443 (Access log: buffer overrun protection), b99f804ad38a (Fixed uninitialized memory read caused by stale regex captures), and 97e40e59b7b4 (Script: avoid garbage at the end of the result string); add e->end pointer and ngx_http_script_check_length() guard to all script copy code paths, reset r->ncaptures on regex reallocation, and thread params_len / headers_len through fastcgi, grpc, scgi, uwsgi upstream request builders so an attacker-controlled map+regex expansion can no longer overrun the assembled request or access log buffer - CVE-2026-42533