websocket

• GHSA-q6xx-5vr8-p898 - Nezha WebSocket stream ownership bypass 2026-06-27
• CVE-2026-39804 - Bandit permessage-deflate decompression DoS 2026-05-02
• CVE-2026-42786 - Bandit WebSocket fragment reassembly DoS 2026-05-02
• CVE-2026-39987 — Marimo pre-auth RCE 2026-04-26