diff --git a/bundle/nginx-1.27.1/src/http/modules/ngx_http_mp4_module.c b/bundle/nginx-1.27.1/src/http/modules/ngx_http_mp4_module.c
index 041ad26..4507282 100644
--- a/bundle/nginx-1.27.1/src/http/modules/ngx_http_mp4_module.c
+++ b/bundle/nginx-1.27.1/src/http/modules/ngx_http_mp4_module.c
@@ -1060,7 +1060,9 @@ ngx_http_mp4_read(ngx_http_mp4_file_t *mp4, size_t size)
 {
     ssize_t  n;
 
-    if (mp4->buffer_pos + size <= mp4->buffer_end) {
+    if (mp4->buffer_pos && mp4->buffer_end
+        && mp4->buffer_pos + size <= mp4->buffer_end)
+    {
         return NGX_OK;
     }
 
diff --git a/bundle/nginx-1.27.1/src/http/ngx_http_script.c b/bundle/nginx-1.27.1/src/http/ngx_http_script.c
index 2ea6113..8f7b548 100644
--- a/bundle/nginx-1.27.1/src/http/ngx_http_script.c
+++ b/bundle/nginx-1.27.1/src/http/ngx_http_script.c
@@ -1037,6 +1037,8 @@ ngx_http_script_start_args_code(ngx_http_script_engine_t *e)
 void
 ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
 {
+    int                           *cap;
+    u_char                        *p;
     size_t                         len;
     ngx_int_t                      rc;
     ngx_uint_t                     n;
@@ -1143,15 +1145,19 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
     if (code->lengths == NULL) {
         e->buf.len = code->size;
 
-        if (code->uri) {
-            if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) {
-                e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
-                                                 NGX_ESCAPE_ARGS);
-            }
-        }
+        cap = r->captures;
+        p = r->captures_data;
 
         for (n = 2; n < r->ncaptures; n += 2) {
-            e->buf.len += r->captures[n + 1] - r->captures[n];
+            e->buf.len += cap[n + 1] - cap[n];
+
+            if (code->uri) {
+                if (r->quoted_uri || r->plus_in_uri) {
+                    e->buf.len += 2 * ngx_escape_uri(NULL, &p[cap[n]],
+                                                     cap[n + 1] - cap[n],
+                                                     NGX_ESCAPE_ARGS);
+                }
+            }
         }
 
     } else {
@@ -1183,6 +1189,7 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
         return;
     }
 
+    e->is_args = 0;
     e->quote = code->redirect;
 
     e->pos = e->buf.data;
@@ -1769,6 +1776,7 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
     le.ip = code->lengths->elts;
     le.line = e->line;
     le.request = e->request;
+    le.is_args = e->is_args;
     le.quote = e->quote;
 
     for (len = 0; *(uintptr_t *) le.ip; len += lcode(&le)) {
diff --git a/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2_filter_module.c b/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2_filter_module.c
index 2024395..bbe08ae 100644
--- a/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2_filter_module.c
+++ b/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2_filter_module.c
@@ -235,6 +235,14 @@ ngx_http_v2_header_filter(ngx_http_request_t *r)
     }
 
     if (r->headers_out.content_type.len) {
+
+        if (r->headers_out.content_type.len > NGX_HTTP_V2_MAX_FIELD) {
+            ngx_log_error(NGX_LOG_CRIT, fc->log, 0,
+                          "too long response header value: "
+                          "\"Content-Type: %V\"", &r->headers_out.content_type);
+            return NGX_ERROR;
+        }
+
         len += 1 + NGX_HTTP_V2_INT_OCTETS + r->headers_out.content_type.len;
 
         if (r->headers_out.content_type_len == r->headers_out.content_type.len
@@ -258,6 +266,13 @@ ngx_http_v2_header_filter(ngx_http_request_t *r)
 
     if (r->headers_out.location && r->headers_out.location->value.len) {
 
+        if (r->headers_out.location->value.len > NGX_HTTP_V2_MAX_FIELD) {
+            ngx_log_error(NGX_LOG_CRIT, fc->log, 0,
+                          "too long response header value: \"Location: %V\"",
+                          &r->headers_out.location->value);
+            return NGX_ERROR;
+        }
+
         if (r->headers_out.location->value.data[0] == '/'
             && clcf->absolute_redirect)
         {
diff --git a/bundle/nginx-1.27.1/src/mail/ngx_mail_imap_handler.c b/bundle/nginx-1.27.1/src/mail/ngx_mail_imap_handler.c
index 291e87a..dc8cbef 100644
--- a/bundle/nginx-1.27.1/src/mail/ngx_mail_imap_handler.c
+++ b/bundle/nginx-1.27.1/src/mail/ngx_mail_imap_handler.c
@@ -48,6 +48,7 @@ ngx_mail_imap_init_session(ngx_mail_session_t *s, ngx_connection_t *c)
 
     if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
         ngx_mail_close_connection(c);
+        return;
     }
 
     ngx_mail_send(c->write);
diff --git a/bundle/nginx-1.27.1/src/mail/ngx_mail_pop3_handler.c b/bundle/nginx-1.27.1/src/mail/ngx_mail_pop3_handler.c
index 226e741..6483528 100644
--- a/bundle/nginx-1.27.1/src/mail/ngx_mail_pop3_handler.c
+++ b/bundle/nginx-1.27.1/src/mail/ngx_mail_pop3_handler.c
@@ -69,6 +69,7 @@ ngx_mail_pop3_init_session(ngx_mail_session_t *s, ngx_connection_t *c)
 
     if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
         ngx_mail_close_connection(c);
+        return;
     }
 
     ngx_mail_send(c->write);
diff --git a/bundle/nginx-1.27.1/src/mail/ngx_mail_proxy_module.c b/bundle/nginx-1.27.1/src/mail/ngx_mail_proxy_module.c
index efed9ab..0decf95 100644
--- a/bundle/nginx-1.27.1/src/mail/ngx_mail_proxy_module.c
+++ b/bundle/nginx-1.27.1/src/mail/ngx_mail_proxy_module.c
@@ -882,6 +882,7 @@ ngx_mail_proxy_write_handler(ngx_event_t *wev)
 
     if (ngx_handle_write_event(wev, 0) != NGX_OK) {
         ngx_mail_proxy_internal_server_error(s);
+        return;
     }
 
     if (c->read->ready) {
diff --git a/bundle/nginx-1.27.1/src/mail/ngx_mail_smtp_handler.c b/bundle/nginx-1.27.1/src/mail/ngx_mail_smtp_handler.c
index e68ceed..8097d91 100644
--- a/bundle/nginx-1.27.1/src/mail/ngx_mail_smtp_handler.c
+++ b/bundle/nginx-1.27.1/src/mail/ngx_mail_smtp_handler.c
@@ -295,6 +295,7 @@ ngx_mail_smtp_greeting(ngx_mail_session_t *s, ngx_connection_t *c)
 
     if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
         ngx_mail_close_connection(c);
+        return;
     }
 
     if (c->read->ready) {
@@ -302,8 +303,8 @@ ngx_mail_smtp_greeting(ngx_mail_session_t *s, ngx_connection_t *c)
     }
 
     if (sscf->greeting_delay) {
-         c->read->handler = ngx_mail_smtp_invalid_pipelining;
-         return;
+        c->read->handler = ngx_mail_smtp_invalid_pipelining;
+        return;
     }
 
     c->read->handler = ngx_mail_smtp_init_protocol;
