Daily Dev Stack Audit — August 27, 2026: BullMQ, Node.js 26.8, and NestJS Round Out a Quieter Week

No new emergency CVE broke today. Next.js's dual RCE fix and Kubernetes 1.37's breaking changes — both covered in yesterday's audit — and the Keycloak/Redis/MongoDB CVE batch from earlier in the week remain the items most worth checking if you haven't patched yet. Today is a cleanup day instead: BullMQ shipped its fifth patch of the week, Node.js hit 26.8, NestJS fixed two startup crashes, ElysiaJS pushed a separate security-only release, and Astro closed out a five-release patch chain. Railway also flagged that its legacy Config as Code path starts deprecating tomorrow. Here's the full sweep across the stack.

Executive Summary

• New this cycle: BullMQ shipped four more patches (v6.2.0 → v6.3.1) since Tuesday's breaking v6.0.0 release, capping the week at v6.3.1 on Aug 27 — the only exact-today release found in this sweep.
• Node.js v26.8.0 / v24.20.0 (Aug 26) add SIV/GCM-SIV cipher modes and a zlib ZIP API; NestJS 11.2.3 / 11.2.2 (Aug 25) fix two separate startup-crash bugs.
• ElysiaJS 1.4.30 (Aug 26) is a security-only release fixing five advisories — distinct from Hono's security fix already covered in yesterday's audit.
• Astro closed out a five-release patch chain through 7.2.8 (Aug 26); 7.2.7 bumps the internal Cloudflare compatibility date, which now requires Wrangler ^4.125.0.
• Railway's legacy “Config as Code” starts deprecating tomorrow, Aug 28, alongside a broader changelog drop (anonymous deployments, Cloud Agents, Redis HA).
• Still worth checking if you haven't: Next.js's dual RCE fix and Kubernetes 1.37's breaking changes (yesterday's audit), and the Keycloak account-takeover CVE plus the Redis/MongoDB/Postgres CVE batch (earlier this week).
• Quiet week, for the record: Radix UI, Tailwind CSS, MUI, Prisma, Drizzle, DuckDB, Express, FastAPI, Kafka, RabbitMQ, and React had no new releases in the trailing seven days — noted per tool below rather than skipped.

Containers, Edge & Infrastructure

Docker

Docker Desktop 4.88.0 and 4.88.1 (Aug 24–25) fix CVE-2026-17106, a destination-escape flaw in docker container cp, plus an unauthenticated Dashboard redirect bug in 4.88.1. Docker Compose 5.5.0 (Aug 17) overhauls image digest reconciliation — expect one container-recreation cycle on the first compose up after upgrading. Docker Engine 29.7.2 (Aug 5) is an older bug-fix release, included here for completeness.

Cloudflare

Nothing new this week. The most recent Workers change is still the Access integration from Aug 14, letting Access policies attach directly to a Worker or apply account-wide by default.

Vercel / Next.js hosting & Kubernetes

Both covered in detail in yesterday's audit: Next.js's dual-RCE emergency release (16.3.3 / 15.5.24) and Kubernetes v1.37.0 “Garhwal” going GA with breaking changes for static pods and cgroup v1 nodes. If you're behind, patch backports v1.36.4, v1.35.8, and v1.34.11 (Aug 20) are available for clusters not yet moving to 1.37.

kubelet:
  featureGates:
    # required on cgroup v1 nodes to keep kubelet starting after 1.37
    failCgroupV1: false

Podman

Podman 6.1.0 (Aug 12) fixed CVE-2026-19730: podman quadlet install --replace failed to truncate the file it was replacing, so a shorter unit file could retain leftover content. New: podman volume rename, podman machine restart, and a retryable podman manifest push --retry.

Cloud Platforms: AWS, Railway, Render

AWS shipped Corretto security patches across every supported LTS line on Aug 18, without publishing specific CVE IDs. Railway's changelog #0304 (Aug 21) is worth a second look given the timing: anonymous no-account deployments, VM-based “Cloud Agents,” Edge Rules, and Redis HA, plus a note that legacy Config as Code starts deprecating tomorrow, Aug 28, 2026, with full discontinuation Dec 1 in favor of a new IaC SDK. Render was quiet; the most recent dated entry is CLI v2.24.0 on Aug 19.

Identity & Authentication (IAM)

Keycloak, Auth0 & the week's CVE backlog

Keycloak's critical account-takeover fix (26.7.2, CVE-2026-18963) was covered earlier this week and remains the top-priority patch in this category if you haven't applied it. The Auth0 ecosystem also carries a standing issue worth knowing about: CVE-2026-42280 in auth0-js (8.11.0–9.32.0) let a crafted invalid ID token paired with a valid access token return the wrong user's profile. It's fixed in 10.0.0+, which also drops HS256 support — a breaking change for apps still configured with HS256.

Authentik

Authentik 2026.8.0 (Aug 18) achieved OpenID Certified™ status across its OP profiles, added OAuth 2.0 token exchange, rewrote the server/proxy outpost in Rust (previously Go), and added PostgreSQL transaction-pooler support. No CVE disclosed this cycle.

Clerk & Better Auth

Clerk shipped Admin Logs (Aug 25, Business/Enterprise) — an audit trail of admin and config actions — and custom OAuth scopes for OAuth applications (Aug 21). Better Auth kept an aggressive cadence: v1.7.2 (Aug 26) hardens URL validation and session handling, and v1.7.0 (Aug 18, breaking) promotes DB joins to a stable API and adds DPoP (RFC 9449) and device-authorization-grant (RFC 8628) support.

import { betterAuth } from "better-auth";
import { dpop } from "better-auth/plugins";

export const auth = betterAuth({
  plugins: [
    dpop(), // RFC 9449 — new in v1.7.0
  ],
});

Auth.js / NextAuth

No new release this week; next-auth remains at 4.24.15. The project has been in maintenance mode under Better Auth's stewardship since September 2025 — security-only fixes, no new features.

Meta-Frameworks & Core Web Standards

Next.js — see yesterday's audit

Next.js's August 2026 security release (16.3.3 / 15.5.24, Aug 25) fixed two critical-severity RCEs — an AVIF image-optimization flaw and a Windows-only path-traversal bug — and was covered in full yesterday. If you haven't upgraded a self-hosted deployment, do that first; it's still the highest-priority item across this entire list.

React

No release this week. Latest are v19.2.8 / v19.1.9 / v19.0.8 (Jul 21) — patch releases improving Server Components decode performance, no breaking changes.

Nuxt & Vue.js

Nuxt's latest is v4.5.2 (Aug 5) — performance work skipping unchanged file rewrites and lazy imports, plus islands/route-param fixes. Nuxt v3 reached end of life on Jul 31, 2026. Vue.js has no stable release this week but is active in release-candidate: v3.6.0-rc.5 (Aug 21) follows a completed Vapor Mode feature set and a reactivity-system refactor built on alien-signals for performance. Vapor Mode's known breaking behaviors (no Options API support, template refs don't expose $el/$props/$attrs/$slots/$refs) remain relevant for anyone adopting the RC.

SvelteKit & Svelte

SvelteKit is iterating fast on its 3.0.0-next line: next.25 (Aug 21) adds an applyReroute helper for split-serverless adapters and streamed responses from async generators; next.24 (Aug 20) adds QUERY HTTP method support in +server.js. All pre-release, no breaking changes flagged. Svelte itself shipped 5.56.10 (Aug 20), a patch release fixing CSS escape-sequence handling and an SSR compile bug in labeled statements.

Astro

Astro closed out a five-release patch chain this week, culminating in 7.2.8 (Aug 26), which bumps the minimum Sharp version to 0.35.4. 7.2.7 (Aug 25) matters for Cloudflare users specifically: it updates the internal Cloudflare compatibility_date, which now requires Wrangler ^4.125.0.

// astro.config.mjs
import cloudflare from "@astrojs/cloudflare";

export default {
  adapter: cloudflare(),
  // ensure Wrangler >=4.125.0 is installed after upgrading to [email protected]+
};

Backend Frameworks, Runtimes & Messaging

NestJS & Node.js

NestJS v11.2.3 (Aug 25) fixes a circular durable-providers bug; v11.2.2 (same day) fixes startup crashes caused by ObserveInstrument and an nestjs-cls proxy-provider crash. Node.js v26.8.0 / v24.20.0 (Aug 26) add SIV and GCM-SIV cipher modes, a zlib ZIP API, and stabilize TracingChannel. Node's most recent CVE batch is still the Jul 29 security release (22.23.2/24.18.1/26.5.1) — 11 CVEs including an HTTP/2 heap-use-after-free.

Fastify & Express

Fastify v5.12.1 (Aug 18–19) is a security release fixing two advisories (GHSA-w2qp-rph6-63g4, GHSA-3m5p-2c4r-xxw2); a 6.0.0-alpha.2 shipped alongside it. Express had no release this week — it remains at v4.22.2 (May 11).

ElysiaJS & Hono

ElysiaJS 1.4.30 (Aug 26) is a security-only release fixing five advisories; maintainers note 1.4.x now ships security fixes only, with active development moved to Elysia 2. Hono's 4.13.5 security release (also Aug 26, three fixes including an incomplete prior patch for a toSSG() path-traversal CVE) was covered in yesterday's audit.

Python & PHP: FastAPI, Django, Laravel

FastAPI had no release this week (latest is 0.141.1, Jul 29) and Laravel had no new release or advisory. Django's most recent security release, 6.0.8 / 5.2.17 (Aug 4), is worth keeping on the radar if you haven't patched: it fixes CVE-2026-15307, a server-side file write/SSRF via GDALRaster with potential RCE.

Background Jobs & Messaging

BullMQ is the mover this week: after Tuesday's breaking v6.0.0 release (Redis connection API replaced by a pluggable IQueueBackend abstraction), the project shipped four more patches — v6.2.0 (Aug 21), v6.2.1/v6.2.2 (Aug 25), v6.3.0 (Aug 26), and v6.3.1 (Aug 27) — the only release in this entire sweep dated exactly today.

import { Queue } from "bullmq";
import { RedisBackend } from "bullmq/backends/redis"; // v6: BackendFactory replaces Connection

const queue = new Queue("emails", {
  backend: RedisBackend.create({ connection: { host: "localhost", port: 6379 } }),
});

RabbitMQ (4.3.5/4.2.10, Aug 17–18) and Apache Kafka had no releases or advisories inside the window — both are running on maintenance builds from the prior cycle. Temporal shipped routine server patch tags (v1.32.0-162.1, Aug 24) with nothing breaking or security-flagged.

UI Systems, Styling & Motion

shadcn/ui 4.19.0 (Aug 21) adds private GitHub registry support via GitHub CLI credentials and a new npx shadcn migrate base-color command. Radix UI, Tailwind CSS, and Material UI (MUI) all had quiet weeks: Radix's newest release-page entry is from Jul 20, Tailwind's stable line is still v4.3.3 (Jul 16), and MUI is at v9.3.1 (Aug 6) — noted here so the absence reads as “checked, nothing new” rather than an omission. Motion (formerly Framer Motion) shipped v13.1.1 (Aug 20), fixing animation-window access in non-browser/SSR environments; its prior v13.0.0 removed the optional @emotion/is-prop-valid dependency, so projects relying on automatic prop filtering now need to configure <MotionConfig isValidProp={isPropValid}> explicitly.

Databases, Caching & Vector Search

No new database CVEs this week — the batch from earlier in the cycle (PostgreSQL 28 CVEs on Aug 13, MongoDB 8.0.29 ~18 CVEs on Aug 11, and Redis 8.10.1 CVE-2026-62356 on Aug 17) was already covered and remains the priority if you haven't patched. pgvector had no release this week (latest is 0.8.6).

ClickHouse shipped several LTS maintenance builds Aug 21–26 (v26.7.5.10-stable, v25.8.32.4-lts, and others) without distinct CVE text attached. DuckDB, Prisma ORM, and Drizzle ORM all had quiet weeks — DuckDB is at v1.5.5 (Jul 22), Prisma's newest changelog entry is Aug 2, and Drizzle remains at v1.0.0-rc.4 (Jun 27).

Supabase & Firebase

Supabase has a breaking change worth flagging: since Aug 5, an explicit version passed to CREATE EXTENSION / ALTER EXTENSION is silently ignored (with a warning), and the extension's default version installs instead — projects that pin specific extension versions should check their migrations. Firebase CLI v15.28.1 (Aug 19) fixed a Dart Cloud Functions version-requirement bug.