CVE-2026-13221: regex trie construction in S_study_chunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches (GH#23388) — decline the trie optimization when the span would overflow
CVE-2026-57432: integer overflow in S_measure_struct pack/unpack size calculation wrapped the signed total negative, letting the @, X and x position codes read out of bounds; croak on overflow and harden the B/b/H/h length math