The August 2026 Patch Wave: Keycloak, Next.js, PostgreSQL, and Redis All Shipped Critical Security Fixes This Week

Executive Summary

• Keycloak 26.7.2 fixes an unauthenticated, CVSS 9.1 account-takeover flaw (CVE-2026-18963) in the reset-credentials flow — patch immediately if you run self-hosted Keycloak.
• Next.js shipped an out-of-band security release (16.3.3 / 15.5.24) for two unauthenticated RCE bugs: a Windows-only Pages/App Router flaw (CVE-2026-75604) and an AVIF image-optimization bug in the libheif dependency chain (GHSA-2xp9-vwfh-vxw4).
• PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24 close out 28 security issues in one coordinated release, alongside 110+ bug fixes.
• Redis 8.10.1 patches a critical heap out-of-bounds write in CMSketch RDB loading (CVE-2026-62356) plus a TLS client-certificate authentication bypass.
• RabbitMQ 4.3.5 fixes CVE-2026-57219 (CVSS 8.7), where an unauthenticated management-plugin endpoint leaked OAuth client secrets usable against IdPs like Entra ID, Auth0, and Keycloak.
• Auth.js / NextAuth closed four security advisories across @auth/core, next-auth v4, and the v5 beta, including a Unicode-normalization email bypass.
• Fastify, ElysiaJS, and Hono all shipped security patch releases within days of each other, alongside a body-parser DoS fix flowing into Express.
• On the feature side: Kubernetes 1.37 "Garhwal", NestJS 12 (ESM-ready, Standard Schema support), Django 6.1, and Docker Compose 5.5 all landed with notable breaking changes worth planning around.

If you only patch five things this week, patch Keycloak, Next.js, PostgreSQL, Redis, and RabbitMQ — in that order.

Critical Security Patches You Need Today

Keycloak 26.7.2 — Unauthenticated Account Takeover (CVSS 9.1)

Keycloak's August 19 release, 26.7.2, fixes eight CVEs. The headline is CVE-2026-18963: a crafted request can jump a session straight to the password-set step of the reset-credentials flow with no email, token, or victim interaction required — a full unauthenticated account takeover. The Hacker News has additional coverage.

Also fixed in this release:

• CVE-2026-15571 — a predictable account-linking hash allows account takeover via a malicious OIDC client.
• CVE-2026-17048 — the Admin REST API could leak vault-resolved, rotated client secrets.
• CVE-2026-14613 and CVE-2026-15945 — fine-grained admin permission bypasses.
• Dependency CVEs in OpenTelemetry and jackson-databind (CVE-2026-45292, CVE-2026-59888, CVE-2026-59889).

This follows 26.7.1 (August 5), which fixed 12 more CVEs including a JWE request-object signature bypass (CVE-2026-9793) and a privilege escalation via role-mapper injection (CVE-2026-4629). The 26.7.0 feature baseline shipped a preview SCIM API, Multi-Cluster HA v2, and SAML step-up auth.

# Check your current version, then upgrade
docker pull quay.io/keycloak/keycloak:26.7.2

Next.js August 2026 Security Release — Two Unauthenticated RCEs

Next.js's August 2026 security release patches Next.js 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS) against two critical vulnerabilities:

1. CVE-2026-75604 / GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers running Pages Router or App Router without Cache Components. Affects 13.4–15.5.23 and 16.0–16.3.2. Linux and macOS deployments are unaffected, and there is no workaround short of upgrading.
2. GHSA-2xp9-vwfh-vxw4 — an unauthenticated RCE reachable through AVIF image optimization, rooted in the sharp → libheif dependency chain. The patch disables AVIF optimization pending an upstream libheif fix.

Vercel's changelog confirms Vercel-hosted deployments were auto-protected (Linux infrastructure, AVIF optimization disabled server-side); self-hosted deployments, especially on Windows, need to upgrade now:

npm install [email protected]
# or, on the maintenance line:
npm install [email protected]

This lands the same week as the feature-focused Next.js 16.3 release, which claims up to 90% less RAM in long dev sessions and up to 22% more requests handled under load.

PostgreSQL — Five Supported Versions Patched, 28 CVEs Closed

The PostgreSQL Global Development Group's August 13 release covers 18.6, 17.11, 16.15, 15.19, 14.24, and 19 Beta 3 in one coordinated update, fixing 28 security issues and 110+ bugs, including:

• CVE-2026-14679 — reject SQL calls to functions taking or returning the internal pseudo-type.
• CVE-2026-14680 — extended-statistics ownership wasn't preserved across ALTER TABLE rebuilds.
• CVE-2026-18024 — a multirange handling fix in pg_restore_attribute_stats().
• CVE-2026-16238 — a type-check fix in scalarineqsel().

The release also bundles tzdata 2026c for Alberta and Morocco DST changes. If you run pgvector alongside Postgres, note that pgvector 0.8.6 (July 29) separately fixed a 32-bit IVFFlat buffer overflow.

Redis 8.10.1 — Critical Memory-Safety Bundle

Redis 8.10.1 (August 17) is a dense security release:

• CVE-2026-62356 — a buffer-size miscalculation in CMSketch RDB loading causes a heap out-of-bounds write.
• An RDB payload with an invalid SLOT_INFO field could trigger memory corruption with potential RCE.
• A TLS client-certificate auth bypass: a NUL byte embedded in a certificate's Common Name could let a client authenticate as a different, possibly more privileged, ACL user.
• Additional fixes: an out-of-bounds access in TopK heap cleanup, a use-after-free in the TLS pending-data list, and validation/use-after-free issues in Vector Sets (VREM/VSIM).

Anyone accepting untrusted RDB files or using TLS client-cert auth for ACL identity should upgrade immediately.

RabbitMQ 4.3.5 — OAuth Secret Leak via Deprecated Endpoint

RabbitMQ's security advisory GHSA-pj24-8j6m-vq9q covers CVE-2026-57219 (CVSS 8.7): the Management Plugin's deprecated GET /api/auth endpoint returned the OAuth management.oauth_client_secret to *any unauthenticated caller*. An attacker could exchange that secret for an admin token against IdPs like Entra ID, Auth0, Keycloak, or Cloud Foundry UAA — leading to full broker takeover. The bug was introduced in RabbitMQ 3.13.0 back in 2024.

Fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, all of which remove the vulnerable endpoint. A related authorization gap, CVE-2026-57221 (CVSS 5.3), let any authenticated user enumerate queues and exchanges cross-tenant; it's fixed in the same version set. The Hacker News covered both flaws when they were disclosed in July.

The same 4.3.5 release also fixes a direct-reply-to bug that caused duplicate message delivery and tightens AMQP 1.0 frame validation.

Auth.js / NextAuth — Four Advisories Closed

Auth.js's July 21 security update closes four GitHub Security Advisories across @auth/core (→ 0.41.3), next-auth v4 (→ 4.24.15), and next-auth v5 beta (→ 5.0.0-beta.32):

• GHSA-7rqj-j65f-68wh (High) — email was validated *before* Unicode normalization, allowing a homoglyph @ bypass.
• GHSA-xmf8-cvqr-rfgj (High) — getToken threw on malformed Authorization headers.
• GHSA-x445-f3h2-j279 (Medium) — OAuth check-cookies weren't bound to the issuing provider.
• GHSA-8fpg-xm3f-6cx3 (Low) — auth checks failed open on provider config errors (v5 middleware only).

Worth noting: Auth.js is now maintained by the Better Auth team, per GitHub discussion #13252.

Backend Frameworks: A Cluster of Security Releases

Three JavaScript backend frameworks patched security issues within days of each other in late August:

• Fastify 5.12.1 (Aug 18) backports fixes for two advisories from the upcoming v6.0.0-alpha line.
• ElysiaJS 1.4.30 (Aug 26) bundles fixes for five advisories; 1.4.x now only receives security patches as development shifts to Elysia 2 (currently 2.0.0-beta.10).
• Hono 4.13.5 (Aug 26) fixes a query-parser fragment-handling bug, completes a prior incomplete fix for path traversal in toSSG() (CVE-2026-39408), and closes an unbounded dot-notation nesting DoS in parseBody().
• body-parser 2.3.0 fixed CVE-2026-12590 (GHSA-v422-hmwv-36x6), where an invalid limit option silently disabled body-size enforcement. This fix is queued into Express's next release per its History.md.

If you run any of these in production, bump the patch versions this week — none of them require a code change beyond the version bump.

Containers, Edge & Infrastructure

Docker shipped across all three products this month: Engine 29.7.2 (Aug 5), Compose 5.5.0 (Aug 17) — which overhauls image-digest reconciliation and may recreate containers once on first upgrade — and Desktop 4.88.1 (Aug 25), a bug-fix release following 4.88.0's fix for a VM networking throughput regression.

Kubernetes 1.37 "Garhwal" released August 26 with 67 enhancements: 16 features graduating to Stable, 23 to Beta, and 27 new Alpha features.

Cloudflare shipped several platform changes worth tracking: Durable Objects now support 10 concurrent Dynamic Workers (up from 4, Aug 28); Access can now gate individual Workers or all Workers account-wide (Aug 14); and Workers AI and AI Gateway billing were unified under one binding and REST API (Aug 7).

Railway rolled out Access Groups for project permissions and Edge Rules plus Redis HA in mid-to-late August, while deprecating Config as Code in favor of a new IaC SDK. Render moved builds to faster CPU/disk nodes, cutting median build time roughly 40%, and introduced new memory-optimized compute tiers.

Podman shipped v6.1.0 with podman volume rename, podman machine restart, and healthchecks that generate Kubernetes livenessProbe entries in podman generate kube — see the release notes (note: the project's GitHub org has moved).

Identity & Authentication

Beyond the Keycloak and Auth.js security releases above:

• Authentik 2026.8 achieved official OpenID Certification from the OpenID Foundation and added Access Requests — self-service app/entitlement requests with approval workflows. Breaking change: the hash_password CLI command no longer accepts passwords as arguments.
• Auth0 rolled out Session Delegation via Custom Token Exchange, letting support agents establish user sessions with a full audit trail, and made Flexible Password Policy the default for new database connections.
• Better Auth 1.7.1 (Aug 18) added native database transaction support to test instances for PostgreSQL and MySQL.
• Clerk shipped Admin Logs (Aug 24–25) — a reverse-chronological audit trail of Dashboard, Backend API, and Platform API configuration changes, available on Business and Enterprise plans.

Meta-Frameworks & Core Web Standards

Next.js's security release is covered above; on the feature side:

• Nuxt 4.5.2 (Aug 5) is a performance-focused patch release. Nuxt 3 reached end-of-life on July 31, 2026, and no longer receives security patches.
• Vue 3.5.42 is the current stable release (Aug 27), with 3.6.0-rc.5 (Aug 21) previewing Vapor Mode and a reactivity-system refactor built on alien-signals.
• SvelteKit 3 entered Release Candidate in late August after 13 preview releases, adding $app/manifest and $app/service-worker modules and built-in shallow routing.
• Astro 7.2 (Aug 6) shipped experimental incremental static builds that skip regenerating unchanged prerendered pages.

Backend Frameworks & Runtimes

• NestJS 12.0.0 (Aug 27) is a major release: ESM-ready core packages with CJS interop, first-class Standard Schema support for Zod/Valibot/ArkType, a new @nestjs/observe observability SDK, and a CLI defaulting to Vitest, SWC, and Rspack. It requires Node.js 20.19+ or 22.12+.
• Node.js 26.8.1 shipped as an out-of-band fix for node --version reporting an incorrect alpha version; 26.8.0 added SIV/GCM-SIV cipher modes and REPL syntax highlighting; 24.20.0 "Krypton" is the current LTS.
• Django 6.1 (Aug 5) adds model field "fetch modes" for controlling lazy-load queries and database-level foreign-key delete options, while dropping support for PostgreSQL <15, MySQL <8.4, MariaDB <10.11, and SQLite <3.37.
• Laravel shipped 13.29.0 and 12.68.0 (Aug 25) with several validation-bypass hardenings, including guarding loose-comparison bypasses in in_array/contains rules.
• FastAPI is at 0.141.1 (Jul 29), a bug-fix release for app.frontend().

UI Systems, Styling & Motion

• Tailwind CSS 4.3.3 fixed --watch --poll support and a Firefox iframe:focus-visible Preflight issue.
• MUI 9.4.0 (Aug 27) adds an opt-in consistent keyboard focus ring via theme.focusVisible.
• Motion 13.1.1 (Aug 18) guards window access for non-browser runtimes and improves AnimatePresence compatibility with React 19 strict mode.
• shadcn/ui added support for private GitHub component registries with fine-grained PAT auth, plus a new multi-step Questionnaire component.

Databases, Caching & Vector Search

PostgreSQL and Redis security releases are covered above. Elsewhere:

• MongoDB Atlas rolled out Lexical Prefilters for Vector Search — fuzzy match, phrase search, and geospatial filters usable ahead of a vector search, now GA across AWS, GCP, and Azure.
• ClickHouse 26.8 LTS landed August 27; the prior stable, 26.6, changed max_insert_threads' default from 1 to auto, a backward-incompatible change that parallelizes INSERT SELECT by default.
• DuckDB 1.5.5 (Jul 22) is a bugfix release covering JSON handling, window functions, and storage management.

Database Tools, ORMs & BaaS

• Prisma ORM 7.10.0 (Aug 25) hardens Prisma Studio's local server to bind to 127.0.0.1 only and reject cross-origin requests; 8.0.0-rc.8 previews the TypeScript-native Prisma 8 CLI.
• Drizzle ORM 1.0.0-rc.4 remains the latest tag, fixing broken View types with subquery selections.
• Supabase moved read-replica management into Project Settings → Infrastructure and fixed a bug where daily backups were occasionally silently skipped.
• Firebase Admin Node.js SDK 14.3.0 (Aug 19) adds Firebase SQL Connect features; the Apple SDK removed Imagen APIs following Google's Imagen model shutdown.

Background Jobs, Messaging & Task Queues

RabbitMQ's security advisory is covered above. Also shipping this month:

• BullMQ 6.3.x landed a run of point releases (6.3.0–6.3.2) through late August, building on v6's pluggable multi-language queue backends for PHP, Python, and Elixir clients.
• Apache Kafka remains at 4.3.1 (Jun 25). Two CVEs from earlier this year are worth confirming you've patched: CVE-2026-41115, an authorization check on the wrong resource type in CONSUMER_GROUP_DESCRIBE, and CVE-2026-35554, a producer buffer-pool race condition that could corrupt or misroute in-flight messages (fixed in 3.9.2, 4.0.2, 4.1.2, and 4.2.0+).
• Temporal previewed Serverless Workers for AWS Lambda (Aug 3) and pre-released the same for GCP Cloud Run (Aug 6), letting Temporal directly manage Worker autoscaling on both platforms.

What to Patch First

Given the volume of security releases this week, prioritize in this order if you're triaging:

1. Redis 8.10.1 and PostgreSQL (14.24–18.6) — memory-safety and RCE-adjacent bugs in your data layer.
2. Keycloak 26.7.2 and Auth.js — authentication bypasses are the highest-leverage bugs an attacker can find.
3. Next.js 16.3.3 / 15.5.24 — especially if you self-host on Windows.
4. RabbitMQ 4.3.5 — if your management plugin is internet-reachable.
5. Fastify, ElysiaJS, Hono, body-parser — low-effort version bumps with no breaking changes.

Everything else in this roundup is a feature or performance release — worth planning for, but not urgent.