Dev Stack Watch: Next.js, Docker, Redis Security Fixes

Executive Summary

Next.js shipped an 8-CVE security release — v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) fix four High-severity issues, including an App Router Server Action DoS and two SSRF flaws.
Docker Engine v29.6.2 patches five CVEs, including a Git bundle-file checkout command-injection bug and a WCOW cache-mount NTFS junction escape.
RabbitMQ disclosed CVE-2026-57219 (CVSS 8.7) — an unauthenticated endpoint on installs using OAuth 2 leaked client secrets, enabling full broker takeover.
Keycloak 26.7.0 fixes three confirmed CVEs, including a TOCTOU privilege-escalation bug and an HTTP parameter-pollution redirect-URI flaw — see the official release notes.
Redis 8.6.5 patches a crafted-stream `RESTORE` use-after-free with potential RCE, following a formal advisory covering five CVEs in earlier 8.x lines.
Node.js has a security release scheduled for July 27, 2026 (26.x/24.x/22.x, highest severity High) — CVE details are embargoed as of publication.
Vue 3.6 enters release-candidate with opt-in Vapor Mode, a new compilation strategy for smaller bundles; Nuxt 4.5.0 adds experimental SSR streaming and moves to Vite 8.
shadcn/ui made Base UI the default component library for new projects (Radix remains fully supported), alongside three security patches in the CLI itself (credential leakage, path traversal, flag injection).
PostgreSQL's May cumulative update fixed 11 CVEs, including a CVSS 8.8 stack-buffer overflow in the `refint` module; no newer point release has shipped since.

Containers, Edge & Infrastructure

Docker

Docker Engine v29.6.2 (July 16, 2026) patches five CVEs: a Git bundle-file checkout command-injection bug (CVE-2026-15793), a buildkit frontend panic (CVE-2026-15792), an LLB file-op flaw allowing `/tmp` deletion (CVE-2026-15791), a destination-directory validation bypass (CVE-2026-15789), and a WCOW cache-mount NTFS junction escape (CVE-2026-15788). Full notes: docs.docker.com/engine/release-notes/29.

Docker Compose v5.3.0/5.3.1 (early-mid July) adds native support for pre-start init containers:

yaml.txt

services:
  app:
    image: myapp:latest
    depends_on:
      - init-db
  init-db:
    image: myapp:latest
    command: ["./migrate.sh"]
    init: true

Docker Desktop v4.83.0 (July 20, 2026) adds per-machine-to-per-user install migration without data loss and fixes `kubectl exec`/`kubectl attach` regressions on Kubernetes v1.36. See release notes.

Kubernetes & Podman

Kubernetes patched three parallel-supported branches on July 22, 2026: v1.36.3, v1.35.7, v1.34.10, with v1.37.0-beta.0 already in pre-release. Details: kubernetes/kubernetes releases.

Podman v6.0.2 (July 22, 2026) fixes WSL-provider `podman machine` cleanup after failed init and a Windows installer PATH bug; an earlier v6.0.0 patched CVE-2026-57231, where malformed image `Env` entries could leak host environment variables into containers. Source: containers/podman releases.

Cloudflare

`@cloudflare/workers-types` v5 trims the package to current-runtime types only.
Workflows moves to per-step billing, metered charges starting no earlier than Aug 10, 2026.
Legacy KV namespace API routes are deprecated (sunset Oct 15, 2026) in favor of `/accounts/{id}/storage/kv/namespaces/*`.
R2 Data Catalog gained read-only API tokens and automatic Iceberg manifest compaction.

Vercel

Vercel's platform changelog highlights Vercel WAF for Blob (beta), Workflow steps extended to 30-minute durations, and Claude Opus 5 added to the AI Gateway. Full log: vercel.com/changelog. (Next.js's own security release is covered below under Meta-Frameworks.)

Cloud Platforms

AWS: S3 Vectors expanded to GovCloud; EKS Auto Mode/ECS Managed Instances cut accelerated-instance fees effective July 1.
Railway: weekly changelog cadence continues — DNS logs and CLI API queries (July 24), a Grok plugin (July 16). See railway.com/changelog.
Render: Managed OIDC now supports Anthropic and OpenAI alongside AWS, and new services default to Bun 1.3.14.

Identity & Authentication (IAM)

Keycloak

26.7.0 (July 9, 2026) adds a preview SCIM API, multi-cluster HA v2 (no external Infinispan requirement), and SAML step-up authentication. It fixes three confirmed CVEs: CVE-2026-9796 (TOCTOU privilege escalation via `manage-clients`), CVE-2026-9689 (HTTP parameter pollution in redirect-URI handling), and CVE-2026-9798 (CIBA flow bypassing brute-force lockout). Details: keycloak.org/2026/07/keycloak-2670-released.

Authentik

2026.5.6 (July 22, 2026) is an incremental patch: fixed SCIM provider group-member handling, added in-process per-IP rate throttling, and removed curl/runit from the container image. See the GitHub release.

Clerk & Auth0

Clerk shipped a `clerk mcp install` CLI command that registers its MCP server across ten AI clients in one step, plus configurable default OAuth scopes for dynamic client registration (changelog). Auth0 moved Third-Party Apps for Organizations to GA and put Anonymous Sessions into beta for stateless guest-checkout flows (changelog).

Better Auth & Auth.js (NextAuth)

Better Auth v1.6.25 (July 23, 2026) fixes an Apple OAuth PKCE bug and a Google One Tap account-creation issue that ignored disabled sign-up (release notes). A v1.7.0-rc is queued with breaking changes, including renaming `Account.accountId` to `Account.providerAccountId`.

next-auth v4.24.15 (July 20, 2026) is a security-focused patch: `getToken()` now returns `null` instead of throwing on malformed Bearer headers, and OAuth state/nonce/PKCE cookies are bound to the provider that created them. Verify via npmjs.com/package/next-auth.

Meta-Frameworks & Core Web Standards

Next.js & React

Vercel's July 2026 security release patches Next.js v16.2.11 and v15.5.21 against 8 CVEs, four rated High: an App Router Server Action DoS (CVE-2026-64641), a Turbopack + single-locale middleware bypass (CVE-2026-64642), and two SSRF issues in rewrites and Server Actions (CVE-2026-64645, CVE-2026-64649).

React 19.2.8 (also backported to 19.1.9/19.0.8, July 21, 2026) is a focused patch improving React Server Components' decoding path, with no new breaking changes. See facebook/react releases.

Nuxt & Vue.js

Nuxt 4.5.0 (July 18, 2026) upgrades to Vite 8, adds Rspack 2 as a builder option, and ships experimental SSR streaming plus a stable `NUXT_E1001`-style error-code system. Nuxt v3 reaches end-of-life July 31, 2026. Details: nuxt.com/changelog.

Vue 3.6.0-rc.2 (July 22, 2026) previews opt-in Vapor Mode — a new SFC compilation mode targeting smaller bundles — built on a reactivity rewrite using `alien-signals`. It is not yet generally available. See vuejs/core releases.

SvelteKit & Svelte

@sveltejs/kit 2.70.1 (July 19, 2026) moves `defineEnvVars` to `@sveltejs/kit/env` and enables CSRF protection in non-production builds by default. An experimental 3.0.0-next prerelease previews a `$app/manifest` module and renamed path types. Svelte 5.56.8 (July 24, 2026) fixes hydration behavior for the `onerror` callback on failed boundaries. Source: sveltejs/kit CHANGELOG.

Astro

Astro 7.1.3 (July 20, 2026) fixes excessive parallel image-optimization processes on CPU-limited build containers. The underlying 7.1 release adds fine-grained CSP directives (`script-src-elem`, `style-src-attr`, etc.) and an `--ignore-lock` flag for running multiple dev servers concurrently. Details: astro.build/blog/astro-710.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS v11.1.28 (July 8, 2026) fixes SSE producer-Observable teardown on client disconnect. NestJS v12, targeted for Q3 2026, is moving core packages from CommonJS to ESM — a major breaking change (tracking PR).

Node.js v26.5.0 ships `blob.textStream()` and an `--experimental-import-text` flag. The most recent disclosed security release (June 18, 2026) patched a WebCrypto AES integer overflow (CVE-2026-48933) and an unbounded-memory `node:http2` issue (CVE-2026-48619) — see the security blog. A further release is scheduled for July 27, 2026 across the 26.x/24.x/22.x lines.

Fastify & Express

Fastify's notable recent fix is CVE-2026-33806 / GHSA-247c-9743-5963 (CVSS 7.5) — a body-schema-validation bypass via a leading space in the `Content-Type` header, fixed in 5.8.5 (advisory). Express's 5.x/4.x lines carry a related dependency fix for CVE-2025-13466 in `body-parser` (DoS via inefficient large-parameter-count handling).

ElysiaJS & Hono

ElysiaJS v1.4.29 (June 16, 2026) normalizes multipart/form-data parsing for better performance; an earlier v1.4.27 fixed a cookie prototype-pollution bug. Hono v4.12.32 hardens query/header parsing via `Object.create(null)`; its June security release fixed a CORS middleware flaw that reflected any Origin with credentials (advisory) and a Body Limit bypass on AWS Lambda.

FastAPI & Django

FastAPI v0.140.0 (July 24, 2026) reduces memory usage in dependency resolution (releases). Django's most recent security release (May 5, 2026 — 6.0.5/5.2.14) fixed CVE-2026-5766, a DoS where ASGI requests with a missing `Content-Length` header bypassed `FILE_UPLOAD_MAX_MEMORY_SIZE`. An earlier February release patched three high-severity SQL-injection CVEs, one of which (CVE-2026-1207, PostGIS raster lookups) was reported as actively exploited.

Laravel

Laravel v13.21.0 (July 14, 2026) adds first-party image processing and Redis session-prefix control. Laravel 13 requires PHP 8.3+ and receives bug fixes through Q3 2027; Laravel 12 remains supported for bug fixes until August 13, 2026. See laravel.com/docs/13.x/releases.

UI Systems, Styling & Motion

shadcn/ui & Radix UI

shadcn CLI v4.13.1 shipped multiple security patches: dropping custom registry headers on cross-origin redirects (credential-leak fix), path-traversal validation for registry file paths, and prevention of flag injection from registry-supplied dependency strings. v4.13.0 made Base UI the default component library for new `shadcn init` projects — Radix remains fully supported via `npx shadcn init -b radix`. Source: ui.shadcn.com/docs/changelog. Radix's unified `radix-ui` package (v1.6.7, July 24, 2026) reverted a breaking change that had broken React Server Components compatibility.

Tailwind CSS

v4.3.3 (July 16, 2026) fixes `@tailwindcss/cli --watch --poll` support and canonicalizes arbitrary hex colors against theme colors case-insensitively (`bg-[#fff]` and `bg-[#FFF]` both resolve to `bg-white`). No v4.4 or v5 has shipped in this window. Source: tailwindcss CHANGELOG.

Material UI (MUI)

@mui/material v9.2.0 (July 3, 2026) adds `data-*` attribute support on `slotProps` via an opt-in TypeScript augmentation. Source: mui/material-ui CHANGELOG.

Motion (Framer Motion)

Motion v12.42.2 (July 1, 2026) fixes cropped group layers so `border-radius` animates correctly in `animateView`. The prior v12.41.0 graduated `animateView` — a View Transitions API wrapper — out of early access into the main library. Source: motion.dev/changelog.

Databases, Caching & Vector Search

PostgreSQL & pgvector

PostgreSQL's cumulative update (18.4, 17.10, 16.14, 15.18, 14.23 — May 14, 2026) fixed 11 CVEs, including a CVSS 8.8 stack-buffer overflow in the `refint` module (CVE-2026-6637) and a libpq `lo_*` functions flaw letting a malicious server overwrite client stack memory (CVE-2026-6477). See postgresql.org/about/news. pgvector v0.8.5 (July 8, 2026) reduces memory usage for small-table IVFFlat index builds (CHANGELOG).

Redis

Redis 8.6.5 (July 23, 2026) fixes a crafted-stream `RESTORE` use-after-free with potential RCE and a Cuckoo Filter data-loss bug on failover. A formal security advisory from May 2026 covers five related CVEs, all patched by 8.6.3 and equivalent OSS/CE lines.

MongoDB

MongoDB's verified recent security release is 8.2.4 (January 27, 2026), fixing six CVEs including CVE-2026-25611, a high-severity issue allowing remote server crashes on deployments with compression enabled. See release notes.

ClickHouse & DuckDB

ClickHouse 26.5 (May 21, 2026, latest stable tag 26.5.6.64) hardened default HTTP request limits (`http_max_fields` cut from 1,000,000 to 1,000) to reduce pre-auth memory abuse, and added hash-join auto-spill to disk. Source: clickhouse.com/docs/whats-new/changelog. DuckDB v1.5.4 "Variegata" (June 17, 2026) fixes VARIANT casting errors and `MERGE INTO` logic bugs (announcement).

Prisma & Drizzle

Prisma's changelog (July 24, 2026) adds S3-compatible Object Store buckets for file storage alongside Prisma Postgres. See prisma.io/changelog. Drizzle's most recent notable release, v1.0.0-beta.22 (April 16, 2026), fixed drizzle-kit generation issues on Windows and MSSQL column-precision handling; the v1.0 line adds MSSQL support across the ORM, kit, and seed packages.

Supabase & Firebase

Supabase deprecated the Management API's `logs.all` endpoint (removal Sept 23, 2026) in favor of a ClickHouse-backed SQL-only `logs` endpoint, and put Supabase Pipelines — managed CDC streaming from Postgres to BigQuery — into public alpha (changelog). Firebase's JS SDK reached v12.16.0 (July 9, 2026), and all Imagen models are being retired in favor of Gemini Image models.

Background Jobs, Messaging & Task Queues

BullMQ

v5.81.2 (July 24, 2026) adds a Valkey Glide Redis-compatible client adapter and prevents an unhandled promise rejection on connection-init failures. Source: taskforcesh/bullmq releases.

RabbitMQ & Apache Kafka

RabbitMQ's July 14, 2026 disclosure covers two CVEs: CVE-2026-57219 (CVSS 8.7) — an obsolete, unauthenticated `GET /api/auth` endpoint leaking OAuth client secrets on installs using confidential-client OAuth 2, present since 3.13.0 — and CVE-2026-57221, a missing-authorization issue letting authenticated users enumerate queue/exchange names beyond their permissions. Fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15; rotating any exposed OAuth secret is required even after patching. Details: security advisory.

Apache Kafka 4.3.1 (June 25, 2026) is a bugfix release, most notably closing a Kafka Streams RocksDB native memory leak (announcement).

Temporal

Temporal Server v1.31.1 (June 10, 2026) bumps Go to 1.26.4 and fixes a search-attribute race condition. The preceding v1.31.0 release brought pre-release Serverless Workers on AWS Lambda and GA'd Worker Versioning and Task Queue Priority & Fairness. A previously disclosed CVE-2026-5724 (missing authentication on an admin gRPC streaming interceptor) was already fixed in 1.28.4/1.29.6/1.30.4 ahead of the current 1.31.x line. Source: temporalio/temporal releases.

Bottom Line

The pattern across today's audit is consistent: security patches are outpacing feature releases in July 2026. Next.js, Docker, RabbitMQ, Keycloak, Redis, and PostgreSQL all shipped CVE fixes within the same two-week window, and Node.js has another disclosure due imminently. Teams running any of these in production should prioritize patching over adopting the newer feature work highlighted above (Vue's Vapor Mode, Nuxt's SSR streaming, shadcn's Base UI default) until the current patch wave is fully rolled out.