Daily Stack Watch: Next.js Patches Two Critical RCEs, Redis Fixes a Heap Overflow, Kubernetes 1.37 Ships

Executive Summary

• Next.js ships an out-of-cycle security release patching two Critical-severity unauthenticated RCEs — upgrade to 16.3.3 or 15.5.24 immediately.
• Redis 8.8.2 closes a RedisBloom heap out-of-bounds write (CVE-2026-62356) plus an ACL bypass and a TLS client-cert auth bypass.
• Cloudflare Workers quietly flips nodejs_compat to enabled-by-default for compatibility dates ≥ 2026-08-04 — a behavior change, not just an addition.
• Kubernetes v1.37.0 ships; v1.34 enters maintenance mode with EOL on Oct 27, 2026.
• Railway's changelog #0304 deprecates Config-as-Code in favor of a new IaC SDK — the old system is fully removed Dec 1, 2026.
• BullMQ v6 removes direct Redis-client access (Queue#client, Worker#blockingClient) in favor of a pluggable IQueueBackend abstraction — a breaking change for anyone touching the underlying client.
• Supabase quietly deprecates extension version pinning as of Aug 5, 2026 — explicit versions in CREATE/ALTER EXTENSION are now ignored in favor of the default install.
• PostgreSQL ships its quarterly maintenance release across every supported branch: 18.6 / 17.11 / 16.15 / 15.19 / 14.24, plus 19 Beta 3.

Critical: Next.js August 2026 Security Release

On August 25, 2026, Vercel shipped an out-of-cycle security release for Next.js, patching Active LTS (16.3.3) and Maintenance LTS (15.5.24) against two Critical-severity, unauthenticated remote code execution vulnerabilities.

• Heap buffer overflow via AVIF image optimization — GHSA-2xp9-vwfh-vxw4 (Next.js) / GHSA-g89c-p67h-r497 (upstream libheif, reached via sharp), CVSS v4 9.5. Triggered when the built-in Image Optimization API processes an attacker-controlled AVIF image. Affects Next.js 13.4–15.5.23 and 16.0–16.3.2. The patched releases disable AVIF optimization entirely until libheif ships an upstream fix.
• Windows-only RCE in Pages + App Router — CVE-2026-75604 / GHSA-p293-qw3h-jr36, Critical severity. Affects servers hosted on Windows that run both the Pages Router and App Router without Cache Components enabled. Linux and macOS deployments are unaffected, and there is no workaround for exposed Windows deployments — upgrading is the only fix.

# Patch immediately
npm install [email protected]   # Active LTS
# or
npm install [email protected]  # Maintenance LTS

If you can't upgrade today, disable image optimization for untrusted sources and confirm you are not serving both routers from a bare Windows host without Cache Components as a stopgap — but treat both as temporary, not a substitute for patching.

Redis 8.8.2 Closes a RedisBloom Heap Overflow

Redis 8.8.2 landed Aug 17, 2026 as a security-flagged release. The headline fix is CVE-2026-62356: an integer overflow when computing buffer size while loading a Count-Min Sketch (RedisBloom) from an RDB file, leading to a heap out-of-bounds write — exploitable via a crafted object passed to RESTORE.

• Out-of-bounds access during TopK heap cleanup.
• Use-after-free in TLS pending-data handling and in blocked-client list management.
• ACL key-permission bypass affecting SORT, GEORADIUS, and XREAD.
• TLS client-certificate auth bypass via an embedded NUL byte in the certificate Common Name.
• ACL privileged-user impersonation bug.

Anyone running self-managed Redis or RedisBloom with RESTORE exposed to untrusted input, ACLs in production, or mTLS client auth should treat this as a same-week upgrade.

Containers, Edge & Infrastructure

Cloudflare Workers

The Workers changelog has been busy all month. The change most likely to bite existing projects: as of compatibility dates ≥ 2026-08-04, nodejs_compat is now enabled by default — previously opt-in, now the default behavior for anything bumping its compatibility date past that threshold.

# wrangler.toml
compatibility_date = "2026-08-04"
# nodejs_compat now applies automatically at or after this date
# pin an earlier compatibility_date if you need the old behavior

• Aug 22 — Wrangler and the Cloudflare API MCP server support choosing optional OAuth scopes at auth time.
• Aug 20 — New “Deployments” tab for Durable Objects: live versions, traffic split, error and wall-time metrics.
• Aug 19 — @cloudflare/vitest-pool-workers renamed to @cloudflare/vitest-plugin (a codemod is provided).
• Aug 14 — Cloudflare Access can now be enabled per-Worker or account-wide.
• Aug 4 — wrangler login --device adds OAuth Device Authorization Grant login, no local callback server required.
• Aug 3 — Python and JavaScript Workers can now call each other via RPC over Service Bindings.

Kubernetes v1.37.0

Kubernetes v1.37.0 shipped Aug 26, 2026. v1.34 entered maintenance mode the following day and reaches end-of-life Oct 27, 2026 — plan upgrades for any clusters still pinned there.

Railway

Railway's changelog #0304 (“Railway for Everyone, Cloud Agents Everywhere, Edge Rules, Redis HA”) ships anonymous deployments (no account required, via railway.com/new), an expanded Cloud Agents CLI (railway ca), new Edge Rules for IP/hostname/path/header-based allow, block, challenge, and redirect logic, and Redis/MySQL High Availability via Sentinel + HAProxy. Config-as-Code is deprecated in favor of a new IaC SDK, with the legacy system fully removed Dec 1, 2026.

Docker Desktop 4.88.1

A bug-fix release (Aug 25, 2026) correcting an issue where opening the Dashboard incorrectly redirected authenticated users back to the sign-in page. See the Docker Desktop release notes for the full 4.88.x component list (containerd v2.3.3, runc v1.4.3, Docker Model Runner v1.2.8).

Meta-Frameworks & Web Standards

Next.js 16.3 — Instant Navigations

Released Aug 3, 2026 (a few weeks ahead of the security patch above), Next.js 16.3 is a substantial feature release:

• “Instant Navigations” — opt-in SPA-like navigation via cacheComponents / partialPrefetching.
• Up to 90% less dev-server RAM usage.
• Up to 5.5x faster repeat builds via disk caching.
• TypeScript 7 support for next build type-checking.
• Up to 22% more SSR throughput from replacing web streams with native Node.js streams.
• Custom error boundaries via catchError, plus a new root params API.
• An experimental Rust-based React Compiler.

Nuxt, Astro & SvelteKit

Nuxt v4.5.2 (Aug 5), @nuxt/ui v4.11.0 (Aug 21), and @nuxt/devtools v3.4.2 (Aug 22) all shipped this month. Astro continues its rapid patch cadence, with v7.2.1 landing Aug 11. SvelteKit's recent minors add an applyReroute helper for split serverless adapters and fix EEXIST errors when symlinking traced files.

Identity & Authentication

Better Auth

Active changelog activity through August (full changelog): a stable placeholder-email utility on placeholder.invalid, a faster nextCookies path for instrumented Next.js apps, and the Redis adapter's listKeys()/clear() switching from KEYS to SCAN to avoid blocking large keyspaces. Note the MCP plugin rename below — it's breaking.

// Better Auth MCP plugin — breaking rename
// before
import { withMcpAuth, mcpHandler } from "better-auth/plugins/mcp";
// after
import { requireMcpAuth, createMcpProtectedRequestHandler } from "better-auth/plugins/mcp";

Keycloak 26.7.0

Most recent notable release (Jul 9, 2026; nothing newer confirmed in August). Ships a preview native SCIM API, experimental multi-cluster HA, and SAML step-up authentication. See keycloak.org for release notes.

Runtimes

Node.js

The most recent security release is still the July 29, 2026 batch (11 CVEs: 3 High, 5 Medium, 3 Low) — no August release has landed yet. If you haven't already, update to 22.23.2, 24.18.1, or 26.5.1.

Databases, Caching & Analytics

PostgreSQL

The Aug 13, 2026 quarterly update covers every supported branch — 18.6, 17.11, 16.15, 15.19, 14.24 — plus 19 Beta 3. No new CVE was disclosed in this cycle.

ClickHouse

v26.7.5.10-stable is the newest stable-branch release (Aug 21, 2026); the 26.3.x and 25.8.x LTS lines are also being actively patched through late August.

Database Tools, ORMs & BaaS

Prisma ORM 8

Prisma is shipping release candidates (rc.5 through at least rc.8) ahead of a stable 8.0 launch: a unified CLI command structure, stronger Postgres idle-connection handling, and a breaking pagination rename.

// Prisma ORM 8 — pagination rename
// before (Prisma 7 and earlier)
prisma.user.findMany({ take: 10, skip: 20 });
// after (Prisma 8)
prisma.user.findMany({ limit: 10, offset: 20 });

Supabase

• Supabase Pipelines — managed Postgres → BigQuery CDC — is now on all paid plans.
• Unified Logs gives a single searchable, live-tailed view across all services.
• Self-hosted Supabase swaps Kong for Envoy as the default API gateway (week of Aug 9).
• Extension version pinning is deprecated as of Aug 5 — explicit versions in CREATE/ALTER EXTENSION are now ignored, with a warning, in favor of the default install. Audit any migration scripts that pin exact extension versions.
• The Realtime schema is now fully locked down against direct DDL changes.

Full details in the Supabase changelog.

Background Jobs & Messaging

BullMQ v6.3.1

The v6.3.1 patch (Aug 27, 2026) fixes SQL directory resolution at runtime for Mix/Elixir releases. The bigger story is the BullMQ v6 major line, which introduces a pluggable IQueueBackend abstraction (Redis and Postgres backends) and removes direct Redis-client access.

// BullMQ v6 — breaking: direct client access removed
// before
const client = await queue.client;
// after
const backend = queue.getBackend();

Temporal

Three platform announcements this month: Serverless Workers for AWS Lambda (Aug 3), Serverless Workers for Google Cloud Run in pre-release (Aug 6), and “Projects” for Temporal Cloud in pre-release (Aug 7) for organizing namespaces and Nexus endpoints.

What To Do Today

• Patch Next.js to 16.3.3 or 15.5.24 if you're anywhere in the affected range — this is the day's top priority.
• Upgrade Redis to 8.8.2 if RESTORE, ACLs, or mTLS client auth are reachable by untrusted input.
• Audit Cloudflare Workers with a compatibility_date ≥ 2026-08-04 for unexpected nodejs_compat behavior.
• If you use Better Auth's MCP plugin, update withMcpAuth/mcpHandler call sites to the renamed APIs.
• Check any pinned CREATE/ALTER EXTENSION versions in Supabase migrations before Aug 5's deprecation surprises a deploy.

Sources & Further Reading

• Next.js — August 2026 Security Release
• Next.js 16.3 release notes
• Redis 8.8.2 release
• RedisBloom security advisory GHSA-q5p6-hwxh-c23h
• Cloudflare Workers changelog
• Kubernetes releases
• Railway changelog #0304
• Docker Desktop release notes
• Nuxt releases
• Astro releases
• Better Auth changelog
• Keycloak
• Node.js July 2026 security releases
• PostgreSQL 18.6/17.11/16.15/15.19/14.24 release announcement
• ClickHouse releases
• Prisma changelog
• Supabase changelog
• BullMQ changelog
• Temporal changelog