Daily Dev Stack Audit: Next.js Ships Emergency RCE Patch, Kubernetes 1.37 Lands

Yesterday's audit flagged Next.js's critical security release as landing "tomorrow." It landed early instead — Vercel moved the patch up after discovering a second critical-severity issue, and shipped both fixes together on August 25. That's the headline today, but it's not alone: Kubernetes v1.37.0 ships today with two breaking changes for kubectl and static Pods, Hono pushed a same-day security release for three parser-level bugs, and a stack's worth of database CVEs from the past two weeks are worth a second look if you haven't patched yet. Here's what actually shipped, and what to act on first.

Next.js's emergency security release: two critical RCE paths

Next.js v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) shipped on August 25, 2026, a day earlier than the countdown we flagged yesterday, after Vercel identified a second critical issue during triage.

• A path-traversal vulnerability that can lead to remote code execution on Windows-hosted servers, affecting Pages and App Router apps that aren't using Cache Components. There is no workaround for this one — upgrading is the only fix.
• An AVIF image-optimization flaw, routed through the bundled sharp/libheif dependency, that lets a crafted image trigger server-side code execution. Teams that can't upgrade immediately can disable AVIF optimization as a stopgap.
• Vercel-hosted deployments are already protected per the Vercel changelog; self-hosted and other platform deployments need to upgrade to 16.3.3 or 15.5.24 directly.

If you run Next.js anywhere outside Vercel's managed platform, this is today's top priority.

Kubernetes v1.37.0 ships today with two breaking changes

Kubernetes v1.37.0 is scheduled for release on August 26, 2026 — today. Two changes in the pre-release notes are worth flagging before you upgrade cluster tooling:

• kubectl run --filename/-f is now deprecated.
• Static Pods can no longer reference Secrets or ConfigMaps via configMapRef/secretRef — the PreventStaticPodAPIReferences feature gate was removed entirely, so this is not opt-out.
• kube-proxy's IPVS mode begins deprecation (disabled by default starting v1.40, removed in v1.43), and cgroup v1 removal continues (failCgroupV1 has defaulted to true since v1.35).

Hono ships a same-day security patch

Hono v4.13.5 landed on August 26, 2026, fixing three issues: a query parser that kept reading parameters after a URL fragment, incomplete path normalization inside toSSG(), and unbounded dot-notation nesting in parseBody() that could be used to exhaust memory. It follows v4.13.4 (Aug 24) and v4.13.0 (Aug 3), which added RFC 10008 HTTP QUERY method support and up to 1.25x faster routing. Full detail in the Hono releases.

Fastify's parallel security releases

Fastify shipped two builds on the same pair of advisories (GHSA-w2qp-rph6-63g4, GHSA-3m5p-2c4r-xxw2): v5.12.1 (Aug 18, stable backport) and v6.0.0-alpha.2 (Aug 19, pre-release). The v6 alpha line also drops deprecated types (FastifyPlugin, FastifyLoggerInstance), removes the Promise.withResolvers ponyfill, and upgrades to undici v8 — plan for breaking changes if you're tracking the v6 alphas. See the Fastify releases.

Identity stack: a critical Keycloak CVE still needs patching

If you haven't patched Keycloak since last week, do it today. Keycloak v26.7.2 (Aug 19) fixes CVE-2026-18963 (CVSS 9.1) — an unauthenticated account-takeover bug in the reset-credentials flow that let attackers skip the emailed verification token entirely. Red Hat build of Keycloak users need 26.4.15 or 26.6.6.

Elsewhere in IAM: Authentik v2026.8.0 (Aug 18) is a routine stable release with no attached advisory. Better Auth v1.7.1 (Aug 18) adds native DB transactions for Postgres/MySQL test instances and patches SAML signature verification in @better-auth/sso. Clerk shipped Admin Logs — an audit trail for workspace config changes — on Aug 25, plus MCP custom OAuth scopes (Aug 21). Auth0's most recent change, effective Aug 3, caps user-profile size at 1KB, a breaking change for tenants relying on larger profiles.

Database security roundup: patch if you haven't

Several database CVEs from the past two weeks remain worth checking against your running versions:

• PostgreSQL 18.6/17.11/16.15/15.19/14.24 (Aug 13) fixed 28 CVEs, including CVSS 8.8 heap-buffer-overflow RCEs in regexp, to_char, and plperl, plus a psql \unrestrict client-side RCE. PostgreSQL 14 hits EOL November 12, 2026. Release notes.
• Redis 8.10.1 and matching point releases across every supported branch (Aug 17) patch CVE-2026-62356, a heap out-of-bounds write from a miscalculated CMSketch buffer size, plus a TLS certificate auth bypass via embedded NUL bytes.
• MongoDB patched CVE-2026-18691 (CVSS 9.0) on Aug 11 — an intra-cluster SASL allow-list gap permitting a PLAIN-mechanism downgrade and cleartext keyfile disclosure between cluster members.
• Django 6.0.8/5.2.17 (Aug 4) fixed CVE-2026-15307, a high-severity flaw where GIS spatial lookups could pass unsafe values to GDALRaster, enabling server-side file writes or SSRF-style requests.
• Podman v5.8.6 (Aug 13) fixed CVE-2026-19730, where podman quadlet install --replace failed to truncate the target file, potentially leaking leftover content when replacing a longer file with a shorter one.
• Docker Engine v29.7.2 (Aug 6, bundled into Docker Desktop 4.88.1 on Aug 25) patches CVE-2026-17106, a destination-escape flaw in docker container cp, via an updated go-archive dependency.

Framework and library updates worth knowing about

• Vue 3.6.0-rc.5 (Aug 21) continues finalizing Vapor Mode and a reactivity refactor built on alien-signals; SvelteKit 3.0.0-next.25 and Svelte 5.56.10 (Aug 20-21) both shipped fixes ahead of stable releases.
• Nuxt v4.5.2 (Aug 5) is a performance-focused patch; Astro 7.2.6 continues its patch series with SSR-manifest and Cloudflare routing fixes.
• NestJS v11.2.3 (Aug 25) and Laravel v13.29.0 / v13.27.0 (Aug 25) both shipped minor/patch updates — Laravel's 13.27.0 adds refreshForUpdate() to Eloquent and a new Cloud facade for queue management.
• Prisma v7.10.0 (Aug 25) hardens Prisma Studio's local server to bind to 127.0.0.1 only and reject cross-origin requests; Prisma v8.0.0-rc.7 shipped the same day, renaming take/skip to limit/offset.
• BullMQ v6.2.2 (Aug 25) is a small deferred-failure rate-limit fix; RabbitMQ 4.3.5 (Aug 17) now requires Erlang ≥ 27.0 to start.
• shadcn/ui v4.19.0 (Aug 21) adds private component-registry support via GH_TOKEN; Motion v13.1.1 (Aug 18) guards SSR runtimes against unsafe window access.
• Railway shipped anonymous no-account deploys and Edge Rules for request handling on Aug 21; Vercel brought AI Gateway pricing changes and Vercel Connect to General Availability on Aug 25.

What to act on today

• Upgrade Next.js immediately if you're self-hosting — the Windows path-traversal RCE has no workaround.
• Confirm Keycloak is on 26.7.2+ if you haven't patched since last week's account-takeover CVE.
• Check PostgreSQL, Redis, MongoDB, and Django against the CVE-patched versions above if you haven't rolled those updates yet.
• Review Kubernetes v1.37.0's breaking changes — static Pod Secret/ConfigMap references and kubectl run -f — before upgrading cluster tooling.