This one is strictly for those Drupal developers still maintaining 6.x sites.

I case you're wondering why your multi-level autocomplete form stopped working correctly after applying the Drupal 6.37 security update, here's why and how to fix it. Admittedly, it's something of an edge case, where you have something like a dropdown box where the user chooses a category which then triggers AHAH to load the appropriate autocomplete text field using the standard CCK nodereference widget. It's something you might design to choose a content type via select box and then a specific node via autocomplete. It's a handy technique for multi-level selections that provides a much better UX than just one long autocomplete collection.

Most likely, you built it using an after_build function to insert the appropriate autocomplete path. The problem is that in 6.37, form.inc now also stores the original path in autocomplete_input in order to store the non-clean path (of the ?q=... variety) to use any time the form gets rebuilt. That overwrites your after_build function's autocomplete_path update. See the release notes for more info on that.

The fix is to update #autocomplete_input in your after_build function so that when the form gets rebuilt it's using your updated path instead of the one that the nodereference module's widget chose originally. Take a look at form_preprocess_autocomplete in form.inc for the details. The place to update the path in your after_build function would be $element[FIELD][INDEX]['nid']['nid']['#autocomplete_input']['#url_value'].