diff --git a/NEWS b/NEWS
index 8c3d62bf..8248e385 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,14 @@
 dbus 1.12.26 (UNRELEASED)
 =========================
 
-...
+Denial of service fixes:
+
+• Fix an incorrect assertion that could be used to crash dbus-daemon or
+  other users of DBusServer prior to authentication, if libdbus was compiled
+  with assertions enabled.
+  We recommend that production builds of dbus, for example in OS distributions,
+  should be compiled with checks but without assertions.
+  (dbus#421, Ralf Habacker; thanks to Evgeny Vereshchagin)
 
 dbus 1.12.24 (2022-10-05)
 =========================