Dev Digest: Postgres, MongoDB & Keycloak CVEs Patched

A concentrated wave of security patches hit the stack this week: PostgreSQL, MongoDB, Keycloak, and Docker Desktop all shipped CVE fixes within days of each other, while Next.js, Vue, Astro, NestJS, and Supabase pushed forward with major feature releases. Below is the full audit across containers, identity, meta-frameworks, backend runtimes, UI systems, databases, ORMs/BaaS, and messaging — with verified release dates and source links for every item.

Executive Summary

• Critical security patches: PostgreSQL 18.6/17.11/16.15/15.19/14.24 (Aug 13) fixed 28 CVEs including three RCE-capable heap buffer overflows; MongoDB 8.0.29 (Aug 11) fixed 19 CVEs; Keycloak 26.7.1 (Aug 5) closed 12 vulnerabilities including a JWE request-object signature bypass.
• Docker Desktop 4.86.0 (Aug 10) patched CVE-2026-17106, a `docker container cp` flaw in the bundled `moby/go-archive` library.
• Better Auth disclosed GHSA-8c5h-wx78-2cfg (Aug 11, High/CVSS 8.1) — an SSO domain-verification race condition enabling account takeover; patched in 1.6.27 and 1.7.0-rc.5.
• Framework momentum: Next.js 16.3.1, Vue 3.6.0-rc.4 (Vapor Mode), Astro 7.2.2, and SvelteKit's `3.0.0-next.23` preview all shipped Aug 13–14.
• Backend runtimes: NestJS 11.2.0/11.2.1 added HTTP `QUERY` method support (RFC 10008); Hono 4.13.2 and Fastify 5.12.0 / 6.0.0-alpha.1 both landed Aug 13; Laravel 13.25.0 shipped a global queue pause switch.
• Infra: Cloudflare Workers added per-Worker Access protection (Aug 14); Podman 6.1.0 and Kubernetes `v1.37.0-rc.0` both progressed toward their next milestones; Railway shipped Access Groups and Agent Connectors (Aug 14).
• Data layer: Supabase CLI v2.114.0 (Aug 12) rewrote several commands from Go to native TypeScript; BullMQ v6.1.1 (Aug 14) continued rolling out its new PostgreSQL-backed queue engine.

Containers, Edge & Infrastructure

Docker

• Docker Desktop 4.86.0 (Aug 10) bundles Engine v29.7.2 and Buildx v0.36.0, and patches CVE-2026-17106 in `docker container cp` (root cause traced to `github.com/moby/go-archive`, fixed upstream in v0.3.0).
• Docker Engine 29.7.2 (Aug 5) fixes a `docker service create/update` panic on duplicate environment variables and an image-pull regression affecting hardlinks on older kernels. Release notes
• Docker Compose v5.4.0 (Aug 3) introduces a new reconciliation model for volume/network lifecycle during `compose apply`, making resource recreation safer. GitHub releases

# Pin the patched Engine/Desktop build
docker version --format '{{.Server.Version}}'
# Expect: 29.7.2 or later

Cloudflare

• Workers: per-Worker and account-wide Access protection shipped Aug 14, exposing `ctx.access.getIdentity()` and local `wrangler dev` testing. Changelog
• Workers AI: DeepSeek V4 Flash/Pro added Aug 14 with a 1,048,576-token context window; Workers AI and AI Gateway moved to unified billing on Aug 7. Changelog
• Pages now skips superseded queued builds (Aug 11); R2 Data Catalog billing was enabled for non-enterprise accounts (Aug 3).

Vercel

• Encrypted Client Hello (ECH) landed on the Vercel CDN (Aug 14) for domains on Vercel DNS. Changelog
• AI Gateway additions: GLM 5.2 free through Blackbox AI, Gemini 3.7 Flash at 50% off, and updated DeepSeek V4 Pro weights (Aug 12–13).
• Two AI SDK harness CVEs — CVE-2026-64650 and CVE-2026-64651 (`@ai-sdk/harness-codex`, `@ai-sdk/harness-opencode`, both CVSS 6.3) — allowed sandboxed code to invoke host tools without model authorization; fixed July 10, publicly reported Aug 6.

Kubernetes & Podman

• Kubernetes v1.37.0-rc.0 (Aug 6) is the latest tag ahead of GA, targeted for Aug 26. Releases
• Podman 6.1.0 (Aug 12) adds `podman volume rename`, `podman machine restart`, and `podman network rm --ignore`, plus Quadlet generation improvements. Release notes

Cloud Platforms

• AWS: DynamoDB native vector search reached GA (Aug 5); Bedrock AgentCore runtime instances went GA (Aug 6) — but also disclosed CVE-2026-18830 (CVSS 8.6, insufficient input validation in the AgentCore InvokeHarness API), already patched server-side.
• Railway: Access Groups (beta) and Agent Connectors (OAuth/MCP for Notion, Linear, Sentry) shipped Aug 14. Changelog
• Render: build infrastructure moved to faster CPU/disk nodes on Aug 7, cutting median build time roughly 40%. Changelog

Identity & Authentication (IAM)

Keycloak

• 26.7.1 (Aug 5) is a security-focused release fixing 12 vulnerabilities, notably CVE-2026-9793 (JWE request object bypassing `requestObjectSignatureAlg`), CVE-2026-4629 (privilege escalation via hardcoded role mapper injection), and CVE-2026-16071 (LDAP entry-DN search boundary bypass).
• Companion Client Libraries 26.0.12 (Aug 5) fixes a related URI-normalization cache-key issue.

Authentik

• No stable release in the audit window; the 2026.8.0-rc7 release candidate (Aug 10) bundles ~50 cherry-picks including Actors/token-exchange delegation and constant-time comparison hardening in auth. Releases

Auth0

• Flexible Password Policy reached General Availability Aug 13, replacing legacy password config with a unified `options.password_options` object.
• Custom Prompts now apply uniformly across Social and Enterprise connections (Aug 10); Session Delegation via Custom Token Exchange entered early access (Aug 7). Changelog

Clerk

• Recent changelog entries: discount/promo codes for Billing (Aug 10), OAuth Client ID Metadata Documents in beta for MCP-style public OAuth clients (Aug 6), Google Workspace directory sync (Aug 5). Changelog

Better Auth / Auth.js

• v1.6.29 (Aug 14) parallelized `deleteSessions` and tightened SSO email-domain auto-assignment to require verified provider + user domains.
• Security advisory GHSA-8c5h-wx78-2cfg (Aug 11, High, CVSS 8.1) covers an `@better-auth/sso` account-takeover flaw from unverified-domain org assignment; patched in 1.4.8, 1.6.27, and 1.7.0-rc.5 — upgrade immediately if you use SSO domain auto-join.
• Auth.js/NextAuth remains in maintenance mode following its handoff to the Better Auth team; no 2026 changelog activity was found.

npm install better-auth@latest
# Confirm you are on 1.6.27+ (or 1.7.0-rc.5+) to pick up the SSO advisory fix

Meta-Frameworks & Core Web Standards

Next.js & React

• Next.js 16.3.1 (Aug 13) fixes Turbopack chunk-stripping and HMR bugs with dynamic imports, prevents image-optimization data loss, and improves `unstable_cache` TTL cleanup. Release
• React has no new stable release in the window; 19.2.8 (Jul 21) remains latest. Experimental canary builds are shipping daily but carry no published release notes.

Nuxt & Vue.js

• Vue 3.6.0-rc.4 (Aug 14) continues the 3.6 RC cycle introducing Vapor Mode and the alien-signals-based `@vue/reactivity` refactor. Release
• Nuxt latest is v4.5.2 (Aug 5) — faster builds via unchanged-file skipping and lazy imports.

SvelteKit & Svelte

• @sveltejs/[email protected] (Aug 13) is part of an active SvelteKit 3 preview cycle that has reorganized `RequestEvent`/`Cookies` type paths — a breaking change to plan for ahead of stable 3.0.
• Svelte 5.56.9 (Aug 12) fixed each-block batching and AST-printer whitespace/comment handling.

Astro

• Astro 7.2.2 (Aug 13) fixes incremental builds dropping optimized images, EMFILE errors under concurrent image reads, and `astro dev` startup failures after Docker container restarts. Release

Backend Frameworks & Runtimes

NestJS & Node.js

• NestJS 11.2.0/11.2.1 (Aug 14) adds HTTP `QUERY` method support (RFC 10008) across core/common/platform-fastify and a new SSE "signal" feature. Releases
• Node.js: the most recent security release remains Jul 29 (fixing CVE-2026-21637, a TLS `loadSNI()` exception bug); the latest Current line is v26.7.0 (Aug 5) with Perfetto tracing support and NSS 3.125 root certs.

Fastify & Express

• Fastify 5.12.0 and the first 6.0.0-alpha.1 both published Aug 13; the 6.0 alpha bumps `undici` to v8.x and raises the minimum Node.js requirement.
• Express has no release in the last month; v4.22.2 (May 11) remains current.

ElysiaJS & Hono

• Hono 4.13.2 (Aug 13) fixes secure-headers output, JSX async-children rendering, and CORS performance; a prior 4.12.34 (Aug 3) was a security release fixing a ReDoS in CORS middleware and an algorithmic-complexity DoS in Language middleware. Releases
• Elysia's ground-up 2.0 rewrite is in active beta (`2.0.0-exp.63`, Aug 13) targeting faster startup, smaller bundles, and AOT compilation; stable is still 1.4.29.

Python & PHP Stacks

• FastAPI 0.141.1 (Jul 29) fixed background tasks/headers not working with `app.frontend()`.
• Django 6.1 (Aug 5) shipped alongside security releases 6.0.8 / 5.2.17 (Aug 4) fixing four CVEs, including CVE-2026-15307, a high-severity SSRF/file-write via spatial lookups. Advisory
• Laravel 13.25.0 (Aug 11) adds a global pause switch for queues and a `foreignUlidFor` schema helper. Changelog

composer require laravel/framework:^13.25
pip install --upgrade django  # pulls 6.1 / patched 6.0.8 line

UI Systems, Styling & Motion

shadcn/ui & Radix UI

• shadcn CLI v4.18.0 (Aug 13) unifies registry config across `package.json` and `components.json`; a new Questionnaire component and a "Human in the Loop" helper (pause-for-approval flows for AI SDK `useChat`) both shipped this month. Changelog
• Radix UI primitives (`react-dialog`, `react-select`, `react-tooltip`) have no stable release since Jul 24; RC prereleases exist as of Jul 31.

npx shadcn@latest add questionnaire

Tailwind CSS & Material UI

• Tailwind CSS latest stable is v4.3.3 (Jul 16); nightly `0.0.0-insiders` engine builds continue shipping daily.
• MUI 9.3.1 (Aug 6) fixed exit transitions getting stuck on unmount; 9.3.0 (Aug 5) moved Toggle Button Group to a roving-tabindex keyboard pattern and added an Autocomplete `status` slot for loading/no-options announcements.

Motion (Framer Motion)

• Motion 13.1.0 (Aug 10) adds multidimensional reorder support and RTL to the `Reorder` component; 13.0.0 (Aug 5) removed the optional `@emotion/is-prop-valid` dependency in favor of an explicit `isValidProp` prop on `MotionConfig` — a breaking change for custom-prop filtering.

Databases, Caching & Vector Search

PostgreSQL & pgvector

• PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24 (Aug 13) fix 28 security vulnerabilities, including CVE-2026-14664, CVE-2026-14669, and CVE-2026-14670 — heap buffer overflows in `regexp`, `to_char`, and `plperl` capable of remote code execution — plus CVE-2026-6464 (psql `COPY FROM STDIN` command injection) and CVE-2026-18408 (`\unrestrict` bypass). This is the most urgent upgrade in today's audit. Announcement
• pgvector 0.8.6 (Jul 29) fixed a 32-bit IVFFlat build overflow and excessive memory use during IVFFlat scans in nested-loop joins.

# Debian/Ubuntu example — adjust for your platform
sudo apt-get update && sudo apt-get install --only-upgrade postgresql-18
psql -c 'SELECT version();'

Redis

• Redis 8.10.0 (Jul 29) adds compact hashes, `HIMPORT`, `LMOVEM`/`BLMOVEM`, and TLS peer-certificate server-to-server auth. A coordinated security wave (8.8.1/8.6.5/8.4.5/8.2.8 and older LTS lines) on Jul 23–24 fixed five CVEs (CVE-2026-23479, CVE-2026-25243, CVE-2026-23631, CVE-2026-25588, CVE-2026-25589) tied to use-after-free issues reachable via `RESTORE` and Lua paths — patch if you haven't already.

MongoDB

• MongoDB 8.0.29 (Aug 11) fixes 19 CVEs (CVE-2026-18687 through CVE-2026-18712), including tightened `$vectorSearch` argument handling and stricter auth requirements around `profile` and prepared-transaction commands. Companion patches 8.3.8 and 7.0.40 shipped the same day. Release notes

ClickHouse & DuckDB

• ClickHouse v26.7.3.19-stable (Aug 6) is a patch on top of the 26.7 line, which added `EXPLAIN ANALYZE`, a `QueryRunner` table engine, and QBit vector-type quantization.
• DuckDB 1.5.5 (Jul 22) is a bugfix release including an out-of-bounds-read security patch and a memory-management deadlock fix.

Database Tools, ORMs & BaaS

Prisma ORM

• Latest changelog entry (Aug 2) adds expression/partial/unique index authoring for Prisma 8, and lets Prisma Compute import any GitHub repo including monorepo subdirectories. Changelog

Drizzle ORM

• No formal release in the window — `1.0.0-rc.5` canary builds are publishing to npm (Aug 11–12) but without an accompanying announcement; the last official RC remains `1.0.0-rc.4` (Jun 27).

Supabase & Firebase

• Supabase CLI v2.114.0 (Aug 12) migrates `db diff`, `db reset`, `functions download`, and `migration squash` from Go to native TypeScript, and adds a `--project-ref` flag. Release
• Scoped Personal Access Tokens entered alpha rollout starting Aug 10; `@supabase/supabase-js` 2.112.3 (Aug 11) improved trace-propagation sampling.
• Firebase JS SDK 12.17.1 (Aug 4) fixed an `npm install` failure for Admin SDK users caused by a `@firebase/database-compat` dependency issue.

npm install -g [email protected]
supabase functions download --project-ref <ref>

Background Jobs, Messaging & Task Queues

BullMQ

• v6.1.1 (Aug 14) fixed parent-options inheritance from root parents; v6.1.0 (Aug 12) made PostgreSQL backend schema migrations explicit, continuing the rollout of BullMQ 6's new `IQueueBackend` abstraction (Redis or Postgres). Changelog

RabbitMQ & Apache Kafka

• RabbitMQ: no August release yet; 4.3.4 (Jul 23) remains latest, addressing quorum queue metrics and AMQP 1.0 parser fixes.
• Kafka: no August release; 4.3.1 (Jun 25) fixed a Kafka Streams RocksDB native memory leak. Kafka's ~3-releases-per-year cadence suggests the next release lands around late September.

Temporal

• No SDK/server release in the strict window, but Serverless Workers for AWS Lambda (public preview, Aug 3) and for GCP Cloud Run (pre-release, Aug 6) both shipped this month, along with Projects for organizing Temporal Cloud resources (Aug 7). Changelog

What to Patch First

• PostgreSQL — 28 CVEs including three RCE-capable overflows; upgrade to 18.6/17.11/16.15/15.19/14.24 immediately.
• MongoDB — 19 CVEs fixed in 8.0.29; prioritize if you run `$vectorSearch` or prepared transactions.
• Better Auth SSO — account-takeover advisory GHSA-8c5h-wx78-2cfg; upgrade if domain auto-join is enabled.
• Keycloak — 26.7.1 closes a JWE request-object bypass and an LDAP boundary bypass.
• Docker Desktop — 4.86.0 patches the `container cp` CVE in `moby/go-archive`.

That's the full sweep for this cycle. All dates and version numbers above were cross-checked against primary sources — official release notes, GitHub release tags, and package-registry timestamps — at the time of writing.