Redis, Keycloak & MongoDB Patch Critical CVEs Today

Executive Summary

Security releases dominate the last 72 hours: Redis 8.10.1 patched nine memory-safety issues including a heap out-of-bounds write in CMSketch RDB loading (CVE-2026-62356); Keycloak 26.7.2 closed several account-takeover paths, including a predictable account-linking hash and a reset-credentials bypass; MongoDB 8.3.8 / 8.0.29 fixed 23 CVEs.
Docker patched “CopyEscape” (CVE-2026-17106), a TOCTOU flaw in moby/go-archive that let a malicious container overwrite host files via docker cp, fixed in Engine/CLI 29.7.2, Desktop 4.86.0, and Sandboxes 0.38.0.
Temporal Server 1.31.2 fixed an unauthenticated gRPC replication endpoint (CVE-2026-5724) on self-hosted deployments, and Fastify 5.12.1 shipped two security advisories alongside routine bug fixes.
Next.js confirmed a scheduled critical-severity security release for August 26, 2026 (patched versions 16.3.3 and 15.5.24) — two days out, and worth blocking time for now.
Breaking changes to plan around: Prisma 8.0.0-rc.7 respells its CLI command surface under a unified CLI; Railway is deprecating Config as Code (new projects stop using it August 28, full sunset December 1); Motion 13.0.0 dropped its implicit @emotion/is-prop-valid dependency in favor of an explicit config option.
New capability launches: shadcn/ui 4.19.0 adds private GitHub registry support; Cloudflare can now attach Access directly to individual Workers; Authentik 2026.8.0 ships Privileged Access Management and auditable agent accounts; Railway launched anonymous no-account deployments and in-dashboard Cloud Agents.

Containers, Edge & Infrastructure

Docker

Docker Compose reached v5.5.0 on August 17, restructuring how image-digest reconciliation works so compose pull respects pull_policy refresh windows — note that existing containers may be recreated once on first upgrade as digests get re-evaluated. Separately, Docker disclosed CVE-2026-17106 (“CopyEscape”), a time-of-check-to-time-of-use flaw in moby/go-archive’s tar extraction that let a malicious container overwrite arbitrary host files — up to root code execution — via docker cp. It’s patched in Engine/CLI 29.7.2, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0.

Sources: Compose v5.5.0 · CVE-2026-17106 advisory

Cloudflare

Cloudflare Access can now attach directly to an individual Worker (August 14), automatically protecting all of that Worker’s domains and preview URLs; accounts can also flip a default that makes all Workers private with per-Worker exemptions. The release adds ctx.access.getIdentity() and local testing via wrangler dev. Separately (August 7), Workers AI and AI Gateway moved to a unified binding/REST path and shared billing, so prepaid AI Gateway credits can now pay for Workers AI inference.

Sources: Workers Access changelog · Workers AI unified billing

Vercel

Recent changelog entries (August 20–21) add DNS/domain/project/member-management commands to the Vercel CLI, custom metrics for Vercel Functions observability, and Toolbar comment management from the CLI. Deployment Storage moved to $0.10/GB/month for new Pro and Enterprise teams, with new retention controls. No new Next.js-specific security or breaking-change release shipped through Vercel’s own changelog in this window — that’s coming via the Next.js security release below.

Sources: Vercel changelog

Kubernetes & Podman

Kubernetes shipped its monthly patch round — v1.34.11, v1.35.8, and v1.36.4 — on August 20, and tagged v1.37.0-rc.1 the same day ahead of the v1.37 GA targeted for August 26. Note that Kubernetes v1.34 enters maintenance mode on August 27 (EOL October 27). Podman reached v6.1.0 on August 12, adding podman volume rename, podman machine restart, podman network rm --ignore, Quadlet ImageVolume= support, and healthcheck-to-livenessProbe conversion in podman generate kube. No breaking changes in this release.

Sources: Kubernetes patch releases · Podman v6.1.0

Cloud Platforms

AWS Glue 6.0 reached general availability on August 21 with a 30% price reduction, a runtime upgrade to Spark 4.1 and Python 3.13, and full Apache Iceberg v3 support (VARIANT type with auto-shredding, deletion vectors). Amazon Bedrock cut GPT-5.6 Sol pricing to $4/$20 per million input/output tokens the same day. Railway’s August 20–21 changelog introduced anonymous no-account deployments, in-dashboard “Cloud Agents” for launching coding-agent sessions into a running VM, IP/path/header-based Edge Rules, and sentinel-backed Redis HA — but it also announced a breaking change: Config as Code is deprecated, with new services in new projects losing it August 28 and a full sunset December 1. Render moved builds to faster CPU/disk nodes on August 7, cutting median build time roughly 40% across all runtimes.

Sources: AWS Glue 6.0 announcement · Railway changelog · Render changelog

Identity & Authentication (IAM)

Keycloak

Keycloak 26.7.2 (August 19) is a security-focused patch addressing an OpenTelemetry unbounded-memory-allocation issue, an admin-permissions bypass via the role-groups endpoint, an admin REST API leak of vault-resolved rotated client secrets, a predictable account-linking hash that could enable account takeover, and an unauthenticated account-takeover path via reset-credentials bypass. It also bumps Jackson-databind to 2.21.5 and the underlying Quarkus runtime to 3.33.3.1. Given the account-takeover surface, this warrants prompt patching — verify the exact CVE list against the release page before citing specific IDs.

Sources: Keycloak 26.7.2 release notes

Authentik

Authentik 2026.8.0 (August 18) is a major feature release: Privileged Access Management (approval-gated app access requests), auditable “agent accounts” that act on a user’s behalf, multi-account browser session switching, scheduled user offboarding, and OAuth2/OIDC token exchange, on-behalf-of delegation, Dynamic Client Registration, and key-bound ID tokens. Two breaking changes: the hash_password management command no longer accepts passwords as a CLI argument (interactive or stdin only), and the WebAuthn “prevent duplicate device” option was removed.

Sources: Authentik 2026.8 release notes

Clerk & Auth0

Clerk added custom OAuth scopes for granular access control and MCP client discovery (August 21) and biometric sign-in — Face ID, Touch ID, Android biometrics — with device-bound key material on its mobile SDKs (August 17). Auth0 opened Early Access for custom per-client rate limits (August 17) and took Flexible Password Policy to general availability (August 13), replacing the legacy password config system with granular composition, history, and dictionary rules; new database connections now default to a 15-character minimum length.

Sources: Clerk changelog · Auth0 changelog

Better Auth / Auth.js (NextAuth)

Better Auth v1.7.1 (August 18) is a bug-fix release: native database transaction support for Postgres/MySQL test instances, a fixed case-insensitive Boolean parser in the SCIM module (improving Microsoft Entra interoperability), a corrected SAML assertion signature verification, a Kysely adapter native-transaction fix, and a CLI guard that now refuses to add required columns without defaults to already-populated tables. Auth.js / NextAuth had no notable release in the last month — the latest published versions remain [email protected] and @auth/[email protected], both from July 20.

Sources: Better Auth changelog

Meta-Frameworks & Core Web Standards

Next.js & React

Vercel confirmed a scheduled security release for August 26, 2026, patching one critical-severity vulnerability as v16.3.3 and v15.5.24 — full advisory details aren’t public yet under Next.js’s newer security-release program, so this is advance notice only. The latest shipped release, v16.3.2 (August 21), is a backport-only bugfix: it scopes app-entry export validation to files inside app/, fixes a catch-all index page being served for other slugs, includes several Turbopack fixes, and switches Turborepo remote-cache auth from a static PAT to OIDC. React shipped v19.2.8 on July 21 — a small patch with a Server Components decoding performance improvement and no breaking changes; no newer React release has landed since.

Sources: Next.js security release notice · Next.js v16.3.2 · React v19.2.8

Nuxt & Vue.js

Nuxt v4.5.2 (August 5) focuses on performance — skipping rewrites of unchanged generated files, lazy imports, skipped HTML entry probes — plus fixes for client-side island navigation, route-param type generation, and Vite sourcemap handling. Vue core shipped a stable bugfix release, v3.5.41 (August 5), while the 3.6 line advanced to v3.6.0-rc.5 (August 21) — still a release candidate — bundling Vapor Mode and a reactivity-system refactor built on alien-signals.

Sources: Nuxt v4.5.2 · Vue core releases

SvelteKit & Svelte

SvelteKit’s stable line landed a single-fix patch, 2.70.3 (August 18), avoiding eager reads of $app/state during module initialization, while its SvelteKit 3 preview track reached 3.0.0-next.25 (August 21) with new $app/manifest and $app/service-worker modules and breaking moves to Vite plugin hooks — not yet stable. Svelte itself shipped 5.56.10 (August 20), a large batch of bug fixes spanning CSS escape handling, custom-property support on components, spread-attribute event cleanup, and effect teardown ordering.

Sources: SvelteKit releases · Svelte 5.56.10

Astro

Astro 7.2.4 (August 19) fixes builds hanging on a malformed image file, base-path stripping incorrectly matching unrelated path segments, a TypeError: Missing parameter on dynamic routes when combining build.format: 'preserve' with trailingSlash: 'always', and Astro.site returning undefined when rendering via the Container API. Matching integration packages (@astrojs/vercel, @astrojs/react, @astrojs/node, @astrojs/mdx) shipped patch bumps the same day.

Sources: Astro releases

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS v11.2.1 (August 14) fixes an early-return Server-Sent Events abort issue in @nestjs/core, following v11.2.0’s HTTP QUERY method support. Node.js’s most recent security release remains July 29 (22.23.2 / 24.18.1 / 26.5.1), fixing 11 CVEs including two High-severity HTTP/2 flaws — CVE-2026-56846 (retained headers bypassing maxSessionMemory) and CVE-2026-56848 (re-entrant send causing heap-use-after-free) — plus a Permission Model path-matching flaw, CVE-2026-58043. No newer official Node.js security or feature release has landed since.

Sources: NestJS v11.2.1 · Node.js July 2026 security releases

Fastify & Express

Fastify v5.12.1 (August 18) is a security-focused patch fixing two GitHub Security Advisories (GHSA-w2qp-rph6-63g4 and GHSA-3m5p-2c4r-xxw2), plus a preClose hook fix so it runs exactly once per declaring instance; v6.0.0-alpha.2 shipped the same day on the path to Fastify 6. Express had no release activity in the last two weeks — the latest published versions remain v5.2.1 and v4.22.2.

Sources: Fastify v5.12.1

ElysiaJS & Hono

Elysia’s stable channel is stale (1.4.29, June 16), but 2.0.0-beta.6 published to npm on August 19 shows active development toward Elysia 2.0 — still a prerelease, with no separate GitHub release notes found for this tag. Hono shipped v4.13.3 (August 18), fixing a client-side URL-corruption bug when replaceUrlParam contains $ tokens, ETag middleware stream-byte and 304-header handling, a CORS Vary header fix on preflight, and router wildcard-matching fixes.

Sources: Hono v4.13.3

Python & PHP Stacks

Django reached 6.1 (August 5), adding configurable model-field “fetch modes” that collapse most N+1 query patterns automatically, database-level delete options for ForeignKey.on_delete, and dictionary-based email backend settings — Django 6.0 now exits mainstream support. A week earlier (August 4), Django shipped security releases 6.0.8 / 5.2.17 fixing four CVEs, including CVE-2026-15307 (High — SSRF/file-write via spatial lookups accepting dict/string raster values) and a stored-XSS flaw in unvalidated URLField links rendered in the Django admin. FastAPI’s latest release remains v0.141.1 (July 29) — a minor fix for background tasks and dependency-injected headers. Laravel shipped framework v13.26.1 (August 18), which reverts the orWhereKey / orWhereKeyNot Eloquent Builder methods added in the immediately preceding release.

Sources: Django 6.1 released · Django security releases · FastAPI 0.141.1 · Laravel framework v13.26.1

UI Systems, Styling & Motion

shadcn/ui, Radix UI & Tailwind CSS

shadcn 4.19.0 (August 21) adds private-repository support for GitHub-based component registries and a new npx shadcn migrate base-color command for switching a project’s base color scheme. Radix UI and Tailwind CSS both had no release within the last two weeks: Radix’s most recent release (≈ July 20–24) covered Dialog/Slider/Toast/Tooltip bug fixes and per-primitive subpath imports, and Tailwind CSS remains on v4.3.3 (July 16) while nightly “insiders” builds continue toward a future v4.4 or v5.

Sources: shadcn 4.19.0 · Radix UI releases

Material UI & Motion

MUI’s latest published version, @mui/material 9.3.1 (August 6), fixed exit transitions getting stuck and a codemod-package publishing bug; the preceding 9.3.0 added roving-tabindex keyboard navigation to Toggle Button Group and closed a prototype-pollution issue in the CSS-variables parser. Motion reached v13.1.1 (August 20), guarding animation window access in non-browser runtimes and improving AnimatePresence compatibility with React 19 strict mode; the earlier v13.0.0 (August 5) is a minor breaking change — it replaced the optional @emotion/is-prop-valid dependency with an explicit MotionConfig isValidProp option.

Sources: MUI Material UI v9.3.1 · Motion changelog

Databases, Caching & Vector Search

PostgreSQL & pgvector

PostgreSQL’s August 13 cumulative release (18.6, 17.11, 16.15, 15.19, 14.24, plus 19 Beta 3) fixed 28 CVEs — including CVSS-8.8 buffer overflows in regexp and to_char processing, a psql COPY FROM STDIN command-injection issue, and a SQL-injection path via EXTRACT expression deparsing — plus 110+ bug fixes. Note that 18.5 was skipped due to a regression, and PostgreSQL 14 reaches end-of-life on November 12. pgvector’s latest release, v0.8.6 (July 29), fixed a buffer overflow affecting IVFFlat index construction on 32-bit platforms.

Sources: PostgreSQL August release · pgvector changelog

Redis & MongoDB

Redis 8.10.1 (August 17), with parallel patches back to 6.2, is a security release fixing nine distinct memory-safety issues — most notably CVE-2026-62356, a miscalculated buffer size in CMSketch RDB loading causing a heap out-of-bounds write, plus an out-of-range SLOT_INFO slot id during RDB loading and use-after-free bugs in the TLS pending-data list and Vector Sets. MongoDB 8.3.8 / 8.0.29 (August 11) fixed 23 CVEs spanning Decimal128 handling, FLE2 compaction/authorization, and a heap use-after-free in collection validation; separately, MongoDB Compass 1.49.6 patched CVE-2026-9101, a prototype-pollution flaw in CSV import that could enable one-click command execution.

Sources: Redis 8.10.1 · MongoDB 8.3 release notes

ClickHouse & DuckDB

ClickHouse shipped v26.7.5.10-stable (August 21), a patch on the 26.7 line that introduced EXPLAIN ANALYZE, WHERE clauses in projections, and AWS MSK IAM auth for Kafka — note the 26.7 line carries a breaking change where S3 SQL access no longer auto-resolves server cloud credentials. DuckDB had no release within the last two weeks; its latest, v1.5.5 (July 22), fixed security issues including out-of-bounds reads in JSON path parsing and string-to-struct casting.

Sources: ClickHouse releases · DuckDB v1.5.5

Database Tools, ORMs & BaaS

Prisma & Drizzle

Prisma’s current stable, 7.9.1 (July 27), patches a transitive-dependency advisory reached through @prisma/dev — not directly exploitable per the release notes, but recommended to quiet automated scanners. The Prisma 8 line is now at 8.0.0-rc.7 (August 20) and carries a breaking change: ORM commands are respelled under a unified CLI (e.g. prisma migrate → prisma db migrate). Drizzle ORM had no citable stable release in this window — the latest formally tagged version remains 1.0.0-rc.4 (June 27); newer builds exist only as untagged canary commits.

Sources: Prisma 7.9.1 · Prisma changelog

Supabase & Firebase

Supabase reorganized its Read Replicas UI into Project Settings → Infrastructure (August 21) and fixed a scheduling-timeout bug that was silently skipping some daily backups (August 12). Firebase shipped its JavaScript SDK v12.18.0 and CLI v15.28.0 together on August 19 — the SDK removed deprecated Imagen APIs and added richer FunctionsError detail, while the CLI fixed a deploy-authentication bug for SQL Connect and now requires Dart SDK 3.13.0+ for Dart functions.

Sources: Supabase changelog · Firebase JS SDK release notes · Firebase CLI release notes

Background Jobs, Messaging & Task Queues

BullMQ

BullMQ v6.2.0 (August 21) adds a generic ProgressType parameter to the Job and Worker classes, letting TypeScript consumers type job-progress payloads precisely instead of falling back to any. It follows v6.1.2 (August 16, dependency/security patch updates) and v6.1.1 (August 14, a parent-options inheritance fix in flows). No breaking changes in this release.

Sources: BullMQ v6.2.0

RabbitMQ & Apache Kafka

RabbitMQ v4.3.5 (August 17) is a maintenance release fixing a direct reply-to bug that could deliver a message more than once, quorum-queue recovery state-initialization issues, and AMQP 1.0 frame-validation hardening; it also adds new stream-protocol connection limits (256 publishers/subscriptions max) and authentication event logging. Apache Kafka’s latest release remains 4.3.1 (June 25), a bug-fix release resolving a critical Kafka Streams RocksDB native memory leak — the next release, 4.4.0, is targeted for September 2026.

Sources: RabbitMQ v4.3.5

Temporal

Temporal Server v1.31.2 (July 8) is a security release patching CVE-2026-5724 (CVSS 6.3) — the streaming gRPC replication interceptor chain omitted the authorization interceptor, letting the AdminService/StreamWorkflowReplicationMessages endpoint accept unauthenticated requests even when a ClaimMapper/Authorizer was configured. Affected lines span 1.24.0 through 1.31.1; fixes landed in 1.28.4, 1.29.6, 1.30.4, and 1.31.2. Temporal Cloud was not affected — this only matters for self-hosted deployments using replication with authorization configured.

Sources: Temporal v1.31.2

What to Patch First

If your team only has time to action a handful of items from today’s audit, prioritize in this order: Redis 8.10.1 (heap out-of-bounds write reachable via RDB loading), Keycloak 26.7.2 (multiple account-takeover paths), MongoDB 8.3.8 / 8.0.29 (23 CVEs), Docker Engine/CLI 29.7.2 and Desktop 4.86.0 (CopyEscape host-file overwrite), and Temporal Server 1.31.2 if you’re self-hosting with replication and authorization enabled. Then set a reminder for August 26 — Next.js’s scheduled critical-severity security release lands that day.