Daily Release Radar: MongoDB, Redis & Next.js Ship Critical Security Patches (July 26, 2026)

Executive Summary

• MongoDB drops a critical patch wave — 7.0.39, 8.0.28, 8.2.12, and 8.3.7 fix 16 CVEs, including a 9.2-critical memory-corruption bug in Compute Mode and an 8.6 RBAC bypass that lets low-privilege users read and write unauthorized data.
• Redis ships an unscheduled follow-up security round — seven versions (6.2.23 through 8.8.1) patch what's being reported as an incomplete fix of the May 2026 CVE-2026-25589 family: a Streams use-after-free and a RedisBloom out-of-bounds write. No new CVE ID has been separately published yet — treat as urgent but verify against Redis's own advisory before assuming full scope.
• Next.js's new monthly security program continues to matter — last week's 16.2.11 / 15.5.21 release fixed 9 CVEs (4 High: Server Action DoS, Turbopack middleware bypass, and two SSRF flaws). Any App Router app on an older build is still exposed.
• Node.js has a coordinated security release scheduled for tomorrow, July 27 — pre-announced for the 22.x, 24.x, and 26.x lines at High severity; CVE details are embargoed until it ships.
• Supabase is deprecating two behaviors developers rely on: extension version pinning stops being honored August 5, and the Management API's logs.all endpoint retires September 23.
• Vue 3.6 enters release candidate with Vapor Mode's feature set complete — a VDOM-free compiler mode plus a reactivity core rewritten on alien-signals, described as the biggest Vue release since 3.0.
• Auth patches worth a look: Better Auth v1.6.25 fixes broken Apple OAuth PKCE and unwanted Google One Tap account creation; Auth.js 4.24.15 ships a security patch binding OAuth state/nonce to the originating provider.

shadcn/ui makes Base UI the default foundation (Radix still supported), and ships a new Toast component and React Aria support alongside it.

• Kubernetes and Podman both cut patch releases this week — Kubernetes v1.36.3, v1.35.7, v1.34.10 and Podman v6.0.2 — routine maintenance, no new CVEs called out in the tags themselves.

Containers, Edge & Infrastructure

Kubernetes & Podman

Kubernetes cut its scheduled patch releases v1.36.3, v1.35.7, and v1.34.10 on July 22–23 — routine maintenance under the official patch cadence, with no CVE flagged in the tag metadata itself. Separately, the actively-exploited ingress-nginx CVE-2026-3288 (config-injection RCE, CVSS 8.8) remains the most consequential open item for anyone still below ingress-nginx 1.13.8/1.14.4/1.15.0.

Podman v6.0.2 (July 22) is a bugfix release — Mac libkrun VMs no longer get killed by port scanners, and `podman machine init` is fixed on Windows/Hyper-V without WSL. The relevant security fix, CVE-2026-57231 (malicious image env-var glob leaking host environment variables into containers, CVSS 7.5), landed in 5.8.4/6.0.0 in late June — patch if you haven't already.

Docker

No new Docker release landed this week. Engine 29 (containerd image store now default, experimental nftables backend) remains current from July 16; if you're still below Engine 29.3.1, CVE-2026-34040 (AuthZ plugin bypass via oversized request body, CVSS 8.8) is still unpatched on your install.

Cloudflare

Cloudflare's July 21 WAF release auto-deployed managed rules for Adobe ColdFusion path traversal (CVE-2026-48276, CVE-2026-48282) and WordPress unauthenticated SQLi/RCE (CVE-2026-60137, CVE-2026-63030) — no action needed unless you've overridden the managed ruleset. The Agents SDK also added AI SDK v6/v7 peer-dependency support on July 23. Note: the legacy Workers KV REST API path is deprecated (hard cutoff October 15) — audit any CI/Terraform scripts still hitting `/accounts/{id}/workers/namespaces/*`.

Vercel

Vercel shipped three feature updates on July 24: WAF for Blob (beta) applies deny/challenge/rate-limit rules to Blob store traffic with no code changes; Workflow steps now support function durations up to 30 minutes; and Claude Opus 5 joined the AI Gateway with BYOK and automatic failover.

AWS, Railway & Render

• AWS: Amazon MWAA now supports Apache Airflow 2.11.2 (security and dependency updates), and Lambda Managed Instances now emit structured JSON lifecycle logs to CloudWatch.
• Railway: queryable DNS resolution logs plus new CLI commands to query Railway's GraphQL API directly, shipped July 24.
• Render: managed OIDC authentication extended to Anthropic and OpenAI (previously AWS-only) — services get short-lived, auto-rotated identity tokens instead of long-lived API keys.

Identity & Authentication

Better Auth v1.6.25 (July 23) fixes Apple OAuth not sending its PKCE code challenge — which was silently breaking token exchange — plus Google One Tap creating accounts even when sign-up was disabled. It follows v1.6.24's dependency patch for an XML-parser security advisory, so treat this as a security-adjacent update if you use Apple Sign-In or One Tap.

Auth.js [email protected] (July 20) is a genuine security patch: it fixes malformed Bearer token handling and binds OAuth state/nonce to the originating provider to close a cross-provider confusion vector.

• Keycloak 26.7.0 patched 4 CVEs (admin-role TOCTOU privilege escalation, CIBA lockout bypass, OIDC redirect-URI parameter pollution) and added a preview SCIM API.
• Authentik 2026.5.6 (July 22) fixes flow-locale regressions and SCIM group-operation bugs; earlier 2026.5.x releases changed the default bind address from 0.0.0.0 to [::], which can break IPv4-only deployments.
• Clerk shipped a `clerk mcp` CLI command that registers the Clerk MCP server across ten AI clients, plus configurable default OAuth scopes.
• Auth0 added Anonymous Sessions (Beta) for stateless guest-checkout style flows with seamless linking into authenticated sessions.

Meta-Frameworks & Core Web Standards

Next.js: 9 CVEs, first monthly security release

Next.js 16.2.11 (Active LTS) and 15.5.21 (Maintenance LTS) shipped July 20 as the first installment of a new preannounced monthly security-release program — 9 CVEs fixed, 4 rated High: a Server Actions denial-of-service via excessive CPU usage (CVE-2026-64641), a Turbopack middleware/proxy bypass affecting single-locale i18n configs (CVE-2026-64642), and two SSRF flaws in rewrites/redirects and custom-server Server Actions (CVE-2026-64645, CVE-2026-64649). Any App Router app using Server Actions, rewrites, or self-hosted Image Optimization should upgrade immediately:

npm install [email protected]
# or for the maintenance LTS line
npm install [email protected]

React

React 19.2.8, 19.1.9, and 19.0.8 landed July 21 as a synchronized patch across three minor lines, improving Server Component response-decoding performance. No CVEs, no breaking changes.

Vue & Nuxt

Vue 3.6.0-rc.2 (July 22) completes Vapor Mode's feature set — a compiler mode that skips the Virtual DOM runtime entirely — and ships `createVaporApp()` plus a `vaporInteropPlugin` for mixing Vapor and VDOM components. `@vue/reactivity` was also rewritten on alien-signals for a meaningful perf/memory win. Not yet production-recommended pending the stable 3.6.0 tag.

Nuxt 4.5.0 (July 18) migrates the build toolchain to Vite 8 and adds Rspack 2 as an alternative bundler, plus experimental SSR streaming, a `useLayout` composable, and a stable `NUXT_E####` error-code system. The Nuxt team calls it groundwork for Nuxt 5; the 3.x line reaches end-of-life July 31.

SvelteKit & Astro

SvelteKit's July roundup (2.62–2.68) lets config live directly in `vite.config.js`, previews explicit env-var declarations to eventually replace `$env/*`, and lets remote functions accept `File` objects without manual FormData wrapping. Astro 7.1 (July 16) adds an `--ignore-lock` flag for running multiple dev servers on one project and finer-grained CSP directives for scripts and styles.

Backend Frameworks & Runtimes

Node.js: security release lands tomorrow

Node.js has a coordinated security release pre-announced for July 27 covering the 22.x, 24.x, and 26.x lines at High severity. CVE details are embargoed until release — if you run any active LTS or current line, plan to patch and redeploy the moment it ships.

Hono, FastAPI & Laravel

Hono v4.12.32 (July 24) hardens query/header/param parsing by switching to `Object.create(null)`, guarding against prototype-pollution-style bugs, and fixes SSE Last-Event-ID handling. It follows a genuine multi-CVE security release in v4.12.25/27 in late June (CORS wildcard handling, Lambda body-limit bypass, path traversal) — make sure you're past that line.

FastAPI v0.140.0 (July 24) reduces memory usage in dependency resolution. Laravel v13.22.0 (July 24) adds a `#[BindWhen()]` conditional-binding attribute and multi-queue support for `queue:clear` — no new CVEs, but Laravel's June advisories GHSA-5vg9-5847-vvmq (CRLF injection in the default email validation rule, High) are worth checking if you haven't patched.

Django, NestJS, Fastify, Express & Elysia

• Django's most recent security release, 6.0.7 / 5.2.16, fixed three Low-severity CVEs including a cache-middleware cookie-leakage bug — upgrade recommended, not urgent.
• NestJS v11.1.28 bumped its Multer dependency for a security patch and fixed SSE teardown behavior on client disconnect.
• Fastify v5.10.0, Express v4.22.2, and ElysiaJS 1.4.29 have no changes newer than a few weeks — nothing new this window.

UI Systems, Styling & Motion

shadcn/ui made Base UI its new default foundation this month (Radix remains supported), alongside a new Toast component with promise/stacking/swipe-dismiss support and React Aria added as a third component foundation.

Radix UI's July 20 release fixed broken ARIA references in Dialog when title/description aren't rendered and stopped Toast from being dismissed on Escape when unfocused. Tailwind CSS v4.3.3 (July 16) added `@container-size` height-based container queries and stacked `@variant` syntax:

@variant hover, focus {
  /* applies when either hover OR focus matches */
}

Material UI and Motion (formerly Framer Motion) have no confirmed updates in this window — MUI's last release was v9.2.0 on July 3.

Databases, Caching & Vector Search

MongoDB: 16 CVEs, one critical

MongoDB 7.0.39, 8.0.28, 8.2.12, and 8.3.7 shipped July 22 fixing 16 CVEs. The headline is CVE-2026-13072 (CVSS 9.2, Critical) — memory corruption in Compute Mode's external-data processing — alongside CVE-2026-13059 (CVSS 8.6), an RBAC bypass letting a low-privilege user read and write data outside their authorization. Check the MongoDB security alerts page and patch immediately if you run Compute Mode or rely on RBAC for tenant isolation.

Redis: unscheduled follow-up patch round

Redis shipped seven versions on July 23 (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1), reported to address an incomplete fix in the May 2026 CVE-2026-25589 family: a Streams shared-NACK use-after-free triggerable via a corrupt RDB load, and a RedisBloom TDigest out-of-bounds write in the RESTORE path. No independent CVE ID had been published as of this writing — treat as urgent given the RCE history of this CVE family, but confirm scope against Redis's own advisory before rolling out broadly:

redis-server --version
# upgrade to the patched line matching your major version, e.g.
apt-get install redis-server=8.6.5-1

PostgreSQL, ClickHouse & DuckDB

• PostgreSQL's 19 Beta 2 landed July 16; the last security release remains May's 11-CVE patch (17.10/16.14/15.18/14.23/18.4). pgvector is stable at v0.8.3, no update this window.
• ClickHouse keeps a weekly cadence: v26.7.1.1315-stable (July 22) and v26.6.2.81-stable (July 21), routine patches.
• DuckDB v1.5.5 (July 22) backports out-of-bounds read fixes for JSON path processing and dictionary string decompression, plus a `TemporaryMemoryManager` deadlock fix.

Database Tools, ORMs & BaaS

Supabase pushed two breaking changes that are easy to miss because neither is a CVE: the Management API's `logs.all` analytics endpoint is being replaced by a ClickHouse-backed, SQL-only `logs` endpoint and retires September 23; and explicit extension version pinning in `CREATE`/`ALTER EXTENSION` statements stops being honored August 5, silently defaulting to latest instead:

-- Before Aug 5: pins to a specific version
CREATE EXTENSION vector VERSION '0.8.3';

-- After Aug 5: version is ignored, latest is installed with a warning
-- Remove version pins from migrations before the cutover date

Prisma added Object Store buckets (July 24) — S3-compatible storage that lives alongside Prisma Postgres/Compute apps, manageable via Console, Management API, or MCP tools. Drizzle ORM and Firebase have no confirmed updates in this window.

Background Jobs, Messaging & Task Queues

BullMQ's polyglot ports are converging fast: JS v5.81.0–5.81.2 added a Valkey Glide client adapter, the Rust port shipped Redis TLS cert support (vrs1.2.0), and the Python port (vpy2.26.0, July 26) ports over JobScheduler, LockManager, AbortController, and QueueEvents — closing most of the remaining feature gap with the core JS library.

RabbitMQ's CVE-2026-57219 (CVSS 8.7, High) — an unauthenticated management endpoint leaking OAuth client secrets — is still the most consequential unpatched risk in this category if you haven't moved to 4.3.0/4.2.6/4.1.11/4.0.20/3.13.15 yet. Apache Kafka and Temporal have no new releases or advisories in this window; Temporal's most recent patches (v1.31.2/v1.30.6) shipped July 8.