security. 114 essays.

Next.js 16.4.5 is a security-only release with seven moderate advisories, mostly around use cache. Also today: Better Auth, Wrangler, Astro, Tailwind CSS and BullMQ.

Four security-focused releases landed in the last 48 hours: Next.js 15.5.29, Hono 4.13.16, Fastify 5.12.8 and Better Auth 1.7.16. Here is what changed and what to upgrade first.

Nuxt 4.6.4 fixes eight advisories, Fastify 5.12.8 ships a GHSA fix, BullMQ patches msgpackr, and Next.js preps a 7-fix security drop. Full release audit.

Better Auth 1.7.15 fixes prototype pollution and redirect bugs, Wrangler 4.156.1 closes a Pages middleware bypass, Next.js flags a Nov 3 security fix.

Hono 4.13.16 patches five advisories in mount(), RegExpRouter, form validation, css and csrf. Plus NestJS 12.3 multer fix and Prisma 8 RC breaking changes.

Node.js 26 becomes LTS, Motion 14.9 adds keyboard-accessible Reorder, BullMQ patches node-redis reconnects, Vue 3.6 RC 14 ships, and Next.js flags seven medium CVEs for Nov 3.

SvelteKit 3.1.1 closes a cross-origin route resolution hole, Wrangler 4.155 and 4.156 harden autoconfig uploads, plus Astro, BullMQ and Motion patches.

Kubernetes 1.37.2 and three backports landed October 28, Next.js 16.5 canary.30 swaps jsonwebtoken for fast-jwt, and Docker 29.9.2 and Keycloak 26.8.1 carry security fixes.

Today's audit: Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 CVEs, Next.js 15 hits end of life, PostgreSQL 19 RC1 arrives, PgBouncer 1.26.1 fixes an auth bypass, and Docker Engine 29.9 is current.

Today's audit: Nuxt 4.6.3 closes five dev-server and routing security gaps, Wrangler 4.153.0 changes secrets-file behavior, plus BullMQ 6.5.0, Better Auth 1.7.14 and Svelte 5.57.3. Node.js and Next.js security patches still apply.

Cloudflare's security-audit skill turns a coding agent into a security auditor: six phases, and a fresh verifier that tries to disprove every lead. It's #1 on GitHub this week and has been in my Helpdock repo since September. Here is a real scoped run on my widget API and what the verdicts mean.

NestJS 11.2.8 hardens pipes and SSE, Better Auth 1.7.13 tightens OIDC checks, Hono 4.13.14 fixes static serving, and Next.js 16.4.3 and Prisma RC land.

Keycloak 26.8.1 patches privilege escalation and token exchange CVEs, Next.js 16.4.3 backports fixes, and BullMQ 6.4.2 pins fast-uri. Daily dev stack audit

A bot scans the internet for fresh Dokploy installs, signs up as the owner on port 3000 before you do, then uses the panel's Docker access to add its SSH key to /root and install a crypto miner. It hit my server two minutes after the installer finished. How to check yours and install safely.

Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs including a Brotli RCE. Plus Astro 7.4.2, Drizzle 1.0 RC5 breaking changes, BullMQ 6.4 and the Prisma 8 RC train.

Next.js 16.4.2 (Oct 15) backports Turbopack fixes onto the critical 16.4.1 security release. What changed and whether to upgrade, plus NestJS 12.2.

Anthropic now scans critical open-source projects for free. Its strongest models build your project in an isolated VM, scan it offline and email each finding with a reproducer and, where possible, a patch. How it works, how to enroll with one pull request, and the first numbers.

Daily audit: Node.js 22, 24 and 26 get HIGH-severity security releases Oct 21. Recap of Next.js 16.4.1 RCE fixes, Docker 29.9.1 and Vercel AI Gateway news.

Monday audit: patch Next.js 16.4.1/15.5.28 for two critical RCEs, update Docker 29.9.1 (containerd 2.4.2) and prep for the Node.js Oct 21 security releases

The biggest reason teams don't switch help desks is migration. Helpdock 0.6.0 adds staff single sign-on (SAML 2.0 and OIDC) and importers that move your Zendesk, Freshdesk or Zoho Desk history in quietly, with a dry run first. How both work, and how I'd plan a cutover.

For 26 years nobody could explain the seeds of the NIST elliptic curves. Anthropic's Frontier Red Team says Claude traced them in under half an hour to a 1990s C random number generator seeded with Unix timestamps. How it worked, code to reproduce every seed, and what it means for ECDSA.

Sunday quiet before the storm: Next.js 16.4.2 and 16.5 canaries, Docker 29.9.1 with containerd 2.4.2, Keycloak 26.8.1, Node 26.12 and Redis security fixes.

Next.js 16.4.2 follows the RCE fixes, Docker Engine 29.9.1 and Desktop 4.95 ship, Node.js previews an Oct 21 security release, and SvelteKit 3.1 lands.

Today's audit: Docker Engine 29.9.1 ships a containerd 2.4.2 security update, Node.js 26.12.0 and 24.22.0 are out, and the Next.js 16.4.1 RCE fixes hinge on the sharp version in your lockfile.

Today's audit: Next.js 16.4.1 and 15.5.28 close two critical RCEs and a Server Actions DoS, React 19.3.1 and SvelteKit 3.1 ship, NestJS 12.1.3 fixes transports, and Node.js pre-announces a HIGH-severity release for October 21.

Next.js 16.4 recommends Cache Components for every app, CVE-2026-75604 (CVSS 9.0) shows exploitation on Windows hosts, Vercel ships an out-of-band security update today, and Docker Compose 5.6.0 adds job support.

Daily changelog audit: Next.js 16.4 flips defaults, Express 5.3 patches dependency CVEs, NestJS 12.1.3 hardens shutdown, and a Critical Next.js security update lands October 14.

Express 5.3.0 upgrades qs, proxy-addr and body-parser to close advisories, Nuxt 4.6.1 ships about 25 fixes, and Hono 5, Vue 3.6 and Elysia 2 reach release candidates.

Next.js will ship an out-of-band security update on October 14, alongside fresh releases from Node.js, Astro, SvelteKit, Nuxt, Prisma and Firebase.