Daily Dev Watch: Auth0, Postgres & Redis Security Fixes

Executive Summary

• Critical Auth0 advisory: CVE-2026-85982 (CVSS 9.0, stored XSS) hits the self-managed Auth0 AD/LDAP Connector, with two companion CVEs including unauthenticated local credential exposure — upgrade to 8.0.0+ immediately.
• PostgreSQL shipped a cumulative patch (18.6/17.11/16.15/15.19/14.24) closing 28 CVEs, several rated 8.1–8.8, including heap buffer overflows reachable via `regexp`/`to_char`/`plperl`.
• Redis 8.10.1 fixes CVE-2026-62356 (heap out-of-bounds write via CMSketch RDB loading) plus a TLS certificate NUL-byte auth bypass.
• Nuxt patched a high-severity server-side RCE in server islands (exploitable only with `vue.runtimeCompiler` enabled) alongside five other advisories.
• Docker Engine/Podman both closed CVE-2026-17106, a container-to-host arbitrary file write via `docker cp`/tar extraction.
• Fastify 5.12.3 and Hono 4.13.7 each shipped standalone security fixes — a validation-bypass/proxy-spoofing pair in Fastify, and unescaped-string XSS in Hono's JSX renderer.
• Next.js 16.3.3 / 15.5.24 was an out-of-band release for two unauthenticated RCE issues (an AVIF image-optimization bug and a Windows-specific flaw).
• On the feature side: React 19.3 stabilizes `<ViewTransition>`, Keycloak 26.7.3 and Authentik 2026.8 both landed major identity-platform updates, Cloudflare quadrupled Worker deploy size limits, and Prisma ORM v8 / Drizzle ORM v1 both approach GA from release-candidate status.
• Package/registry snapshot: Kubernetes 1.37.0, Tailwind CSS 4.3.3, MUI 9.4.0, Motion 13.2.0, ClickHouse 26.8 LTS, BullMQ 6.3.4, RabbitMQ 4.3.5, and Apache Kafka 4.3.1 are the current stable lines across their respective ecosystems.

Containers, Edge & Infrastructure

Docker

Docker Engine v29.8.0 (Sept 3) adds a `--umask` flag for `docker create`/`run` and bumps BuildKit to v0.33.0. The more consequential fix landed a few weeks earlier: CVE-2026-17106, a container-to-host arbitrary-file-write flaw in `docker cp` disclosed via Docker's security announcements. Docker Desktop 4.90.0 (Sept 7) also patches its bundled Kind cloud-provider image for CVE-2026-46595 and CVE-2026-39834. Docker Compose v5.5.1 adds lifecycle-hook output capture and improved OpenTelemetry tracing.

# New in Docker Engine 29.8.0
docker run --umask 0027 my-image

Cloudflare

Three changes worth tracking from the Cloudflare changelog: the Worker deploy size limit jumped to 64 MiB on both Free and Paid plans (up from 3MB/10MB); Python Workers now default to Python 3.14 for compatibility dates from Sept 8 onward; and D1 on the Free plan now hard-fails once daily row read/write quotas are exceeded. R2 Data Access Logs also reached general availability.

Vercel

The Vercel changelog shows Sandbox default storage doubling to 64GB, GitHub Copilot joining the AI SDK harness layer, and AWS PrivateLink support for Functions/builds on Pro/Enterprise. Separately, Next.js shipped an out-of-band security release — 16.3.3 / 15.5.24 — fixing an unauthenticated AVIF image-optimization RCE and a Windows-specific RCE (GHSA-p293-qw3h-jr36). The current feature line is Next.js 16.3, which cuts Turbopack dev-server memory by up to 90% and introduces opt-in Instant Navigations.

Kubernetes & Podman

Kubernetes v1.37.0 (Aug 26) is the current stable minor; note that containerd 2.0+ is now required going forward. Podman 6.1.0 adds new Quadlet options and fixes the same tar-extraction issue tied to CVE-2026-17106 that affected Docker.

Cloud Platforms

AWS's notable items this week include an Amazon Linux 2027 public preview (SELinux enforcing by default) and GuardDuty Custom Detection Rules. Railway's CLI gained Postgres management and agent-connection features, while Render shipped a redesigned Deploys page with full rollout history.

Identity & Authentication (IAM)

Keycloak

Keycloak 26.7.3 is a security release bundling roughly 20 CVE fixes, including an LDAP hostname-verification flaw, a weak-JWT-assertion OIDC bypass, and an account-takeover path via the reset-credentials flow. No breaking API changes.

Authentik

Authentik 2026.8.2 (Sept 9) is a maintenance patch on top of the 2026.8 line, which introduced Privileged Access Management with approval workflows, Agent Accounts, and OIDC token-exchange support — authentik is now OpenID Foundation certified. Breaking changes in 2026.8: `hash_password` no longer accepts the password as a CLI argument, and forwarded headers are now restricted to trusted proxies by default.

Clerk & Auth0

Clerk shipped OAuth Device Authorization Grant (RFC 8628) for CLI/TV/browserless sign-in flows. Auth0's news is more urgent: a critical stored-XSS advisory (CVE-2026-85982, CVSS 9.0) affects the self-managed AD/LDAP Connector below v8.0.0, alongside a code-execution issue (CVE-2026-85983) and an unauthenticated local credential-exposure bug (CVE-2026-85981). Any self-hosted connector should be upgraded immediately.

Better Auth / Auth.js

Auth.js patched four vulnerabilities in July, including an email-validation bypass via Unicode homoglyphs and OAuth state cookies not bound to their issuing provider:

npm install [email protected]   # v4 LTS
npm install [email protected]   # v5 beta

Auth.js maintenance now runs through the Better Auth team's channels; Better Auth itself is at v1.7.4 and is the recommended choice for new projects.

Meta-Frameworks & Core Web Standards

Next.js & React

React 19.3 (Sept 9) stabilizes `<ViewTransition>` and Fragment Refs, enabling native browser View Transition animations without experimental flags. Next.js's headline release remains 16.3 (see Vercel section above for its out-of-band security patch).

Nuxt & Vue

Nuxt's security release (v4.5.1/v3.21.10) fixed a high-severity server-side RCE in server islands — exploitable only when `vue.runtimeCompiler` is enabled:

// nuxt.config.ts — confirm this stays disabled unless required
export default defineNuxtConfig({
  vue: { runtimeCompiler: false }
})

Five other advisories were patched in the same release, including a route-rule authorization bypass. Separately, Vue 3.6.0-rc.7 completes the Vapor Mode feature set for a smaller, faster compilation strategy.

SvelteKit & Svelte

SvelteKit 3 is in release candidate, moving configuration from `svelte.config.js` into `vite.config.ts` and renaming the `$lib` alias to `#lib`. Migrate with `npx sv@next migrate sveltekit-3 --tasks all --confirm`.

Astro

Astro 7.3.2 (Sept 8) fixes MDX script/style escaping and Cloudflare adapter session issues in dev mode; 7.3.0 added concurrent preview servers via `astro preview --ignore-lock`.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS 12.0.1 completes a full migration of official packages from CommonJS to ESM and swaps Jest/ESLint/Webpack for Vitest/oxlint/Rspack by default. Node.js 26.8.2 (Current) bumps Undici to 8.10.2 and OpenSSL to 3.5.8.

Fastify & Express

Fastify 5.12.3 closes two CVEs: a schema-validation bypass (CVE-2026-18504) where coerced vs. uncoerced values diverged, and an X-Forwarded-* spoofing issue (CVE-2026-16732) when `trustProxy` is set via hop count. Express itself hasn't shipped a core update, but its `body-parser` dependency patched a DoS (CVE-2026-12590) where an invalid `limit` option silently disabled body-size enforcement — upgrade to `[email protected]`/`2.3.0`.

ElysiaJS & Hono

Hono 4.13.7 fixes an XSS in `hono/jsx` where plain strings rendered unescaped inside `Suspense`/`ErrorBoundary`/`Context.Provider` (GHSA-hxh3-vqpv-xpqv) — upgrade if you render any untrusted string through these APIs. Elysia's stable line (1.4.30) is now security-only while Elysia 2 — rewritten around ahead-of-time compilation — sits at beta.14.

Python: FastAPI & Django

Django 6.1.1 is a bugfix release on top of the August 4 security release (6.0.8/5.2.17), which fixed a flaw letting a low-privileged staff user trigger disk writes or network requests via spatial-field lookups. FastAPI's latest stable is still 0.141.1.

PHP: Laravel

Laravel 13.31.0 (Sept 8) continues the 13.x line's recent additions: a `Cloud` facade for managed queues, `AsVector` Eloquent casts with MariaDB vector-distance queries, and automatic retry of safe Redis commands after transient failures.

UI Systems, Styling & Motion

shadcn/ui & Radix UI

shadcn/ui CLI 4.21.0 introduces a dedicated `cn` package replacing the locally duplicated `lib/utils.ts` helper:

pnpm dlx shadcn@latest migrate cn

Radix UI's unified `radix-ui` package is stable at v1.6.7, with Base UI now the default primitive for new shadcn projects (Radix remains fully supported).

Tailwind CSS

Tailwind CSS 4.3.3 adds case-insensitive hex color matching and fractional opacity modifiers on shadow utilities. The bigger headline is organizational: Tailwind Labs is joining Shopify.

Material UI

MUI 9.4.0 adds `theme.focusVisible` for consistent keyboard focus rings and lets `Tooltip` wrap disabled buttons directly without an extra `<span>`.

Motion

Motion 13.2.0 adds `animate.addEffect()` for driving non-DOM subjects, with new Three.js plugins. Note the earlier v13.0.0 breaking change: `@emotion/is-prop-valid` was removed in favor of explicit `<MotionConfig isValidProp={isPropValid}>`.

Databases, Caching & Vector Search

PostgreSQL & pgvector

PostgreSQL's August cumulative release closes 28 CVEs across the 14–18 lines plus a 19 Beta 3, including CVE-2026-14664/14669/14670 (heap buffer overflows in `regexp`/`to_char`/`plperl` reachable for arbitrary code execution) and CVE-2026-15741 (SQL injection via `EXTRACT`). Patch promptly:

sudo apt-get update && sudo apt-get install --only-upgrade postgresql-18

pgvector 0.8.6 fixes a 32-bit buffer overflow in IVFFlat index builds.

Redis

Redis 8.10.1 is a security release fixing CVE-2026-62356 (heap out-of-bounds write via CMSketch RDB loading), a TLS use-after-free, and a TLS certificate NUL-byte authentication bypass. All Redis OSS/Software/Stack deployments should upgrade; Redis Cloud is already patched.

MongoDB

The current stable line remains MongoDB 8.3, whose Cost-Based Ranker is now the default query-plan selection path for eligible queries. No new server patch was found this week.

ClickHouse & DuckDB

ClickHouse 26.8 LTS ships SQL-defined HTTP handlers and pipe-operator syntax (`FROM t |> WHERE ...`), alongside backward-incompatible changes to `X-ClickHouse-Format` header handling. DuckDB's v2.0 "Cyanoptera" alpha adds asynchronous I/O for Parquet/CSV reads, targeting a full release in the second half of October.

Prisma & Drizzle

Prisma ORM v8.0.0-rc.9 tightens PostgreSQL enum ordering and MongoDB attribute validation, continuing the RC series' consolidation onto `prisma.config.ts` as the sole config format. Drizzle ORM's v1.0.0-rc series adds native Effect v4 support and JIT row mappers reported to cut mapping overhead by 25–30%; neither Prisma v8 nor Drizzle v1 has reached general availability yet.

Supabase & Firebase

Supabase is retiring the Management API's `logs.all` endpoint on September 23 in favor of a ClickHouse-backed `logs` endpoint — a breaking change for anyone scripting log pulls. Firebase Admin Node.js SDK 14.4.0 deprecates the Firebase ML module ahead of a June 2027 shutdown.

Background Jobs, Messaging & Task Queues

BullMQ

BullMQ 6.3.4 bumps the Rust `croner` crate to v4 for a security fix; no new features in this release.

RabbitMQ & Apache Kafka

RabbitMQ 4.3.5 fixes duplicate direct-reply-to message delivery and adds AES-256-GCM credential encryption in the management UI. Apache Kafka 4.3.1 fixes a Kafka Streams RocksDB native memory leak, with a 4.4.0 release candidate now in testing.

Temporal

Temporal Server 1.31.2 addresses CVE-2026-5724 and adds authorization coverage for the replication streaming endpoint — operators using authorization with replication may need to set `system.disableStreamingAuthorizer=true` to avoid connection errors after upgrading.

What to Patch First

If your team only has time for a handful of upgrades this week, prioritize in this order: Auth0 AD/LDAP Connector (critical XSS, CVSS 9.0), PostgreSQL (28 CVEs, several critical), Redis 8.10.1, Nuxt's server-island RCE fix, Docker/Podman's CVE-2026-17106, and Fastify 5.12.3. Everything else in this roundup is feature work that can follow your normal upgrade cadence.