Unbound 1.26.1 fixes nine CVEs; nginx 1.31.6 fixes one this build never compiled

Unbound 1.26.1 was published at 08:22 UTC and was serving here at 11:48 UTC. It consolidates nine CVEs and ships a Changelog that mentions none of them, so the mapping from identifier to code had to be recovered by diffing the trees. nginx 1.31.6 carries CVE-2026-90439, whose fix is confined to the OpenSSL compatibility layer - code a BoringSSL build does not compile.

TL;DR

Unbound 1.26.1, published 16 September at 08:22 UTC, consolidating nine CVEs: CVE-2026-77860, -77955, -78227, -80225, -81634, -81642, -82717, -82720 and -85501. The rebuilt binary was serving here at 11:48 UTC.
The release does not say which fix is which. doc/Changelog inside the signed tarball has no CVE entries at all - its newest line is dated 24 July. Diffing 1.26.0 against 1.26.1 recovers it: 36 source files differ, two of them tests.
nginx 1.31.6 on 15 September, with CVE-2026-90439 (medium, CVSS 6.5, vulnerable 1.29.2-1.31.5). Every changed line sits in the OpenSSL compatibility layer, which src/event/quic/ngx_event_quic.h compiles only when the TLS library has no QUIC API of its own - so not for OpenSSL 3.5.0+, QuicTLS, BoringSSL, AWS-LC or LibreSSL.
Checked rather than assumed: on this build ngx_event_quic_openssl_compat.o contains no symbols and the shipped binary contains no quic_compat symbol. The master process was replaced under a live socket on 15 September at 20:52; the unit has not left active since 12 September.

Three of the nine Unbound identifiers reach any validating resolver, and the other six depend on what the instance is configured to serve. This one listens on loopback with the encrypted transports terminated in front of it and hosts no authoritative zones, so the DoH, DoQ, TCP/DoT and ZONEMD identifiers do not describe a path anything outside the host can take. That is a reason to be relaxed about the timing of an upgrade, not a reason to skip one - the code is in the binary either way.

The full patch reading, including the two new configurable validation limits that no advisory mentions, is in nine CVEs in one Unbound release. The previous update pass is nginx 1.31.5, Go 1.27.1, and a month of BoringSSL not taken.