Dev Release Radar — August 3, 2026: Next.js, Nuxt & Node Patch Critical CVEs

Three frameworks patched high-severity vulnerabilities within the same seven-day window this cycle. Next.js shipped a coordinated multi-CVE security release, Nuxt fixed a critical unauthenticated RCE in DevTools, and Node.js patched 11 CVEs including a request-smuggling bug in its HTTP parser. Alongside the security work, BullMQ shipped a breaking v6 with pluggable queue backends, ClickHouse tightened default S3 credential resolution, and RabbitMQ raised its minimum supported Erlang version. Here is everything that shipped across the stack between late July and August 3, 2026.

Executive Summary

• Next.js patched three High-severity CVEs (Server Actions DoS, Turbopack middleware bypass, rewrite-based SSRF) plus six Medium-severity issues in a single July 2026 Security Release — update to 16.2.11 or 15.5.21 immediately.
• Nuxt fixed a Critical (CVSS 9.6) unauthenticated RCE in Nuxt DevTools reachable over the Vite HMR WebSocket, plus a High-severity SSR template-injection RCE and an auth-bypass regression — all three advisories are linked below.
• Node.js shipped a security release across the 26.x, 24.x, and 22.x lines fixing 11 CVEs, including two High-severity HTTP/2 bugs and a Permission Model over-grant.
• MongoDB Server 8.0.28 is a security and reliability patch fixing CVE-2026-9737 and a run of CVE-2026-130xx issues around FLE2 and authorization checks.
• Hono v4.12.34 closed four freshly disclosed advisories, including a ReDoS in the CORS middleware and a cross-user data-disclosure bug in `memo()` SSR caching.
• BullMQ v6.0.0 is a breaking release: `Queue#client` and friends are removed in favor of `getBackend()`, repeatable jobs via `repeat` are gone in favor of Job Schedulers, and a new pluggable backend layer adds PostgreSQL as an alternative to Redis.
• ClickHouse 26.7 stops resolving the server's own cloud credentials for user-issued S3 queries by default — a backward-incompatible security hardening change.
• RabbitMQ 4.3.4 / 4.2.9 raise the minimum supported Erlang/OTP version to 27.0; nodes on older Erlang will fail to start after upgrading.
• Supabase is migrating self-hosted deployments from Kong to Envoy as the default API gateway starting the week of August 9, 2026, and is deprecating explicit Postgres extension version pinning from August 5.

Quiet this cycle: Docker Compose, Kubernetes, AWS, NestJS, Express, ElysiaJS, Material UI, Drizzle ORM, Apache Kafka, and Temporal had no dated releases inside the research window — see the roundup at the end.

Containers, Edge & Infrastructure

Docker

Docker Engine 29.7.1 (July 31) is a bugfix release fixing an image-pull regression for layers without explicit parent-directory entries and a `CopyToContainer` path-traversal-of-symlinks bug. The preceding 29.7.0 patched a security issue, CVE-2026-17106, by bumping `github.com/moby/go-archive` to v0.3.0.

Docker Desktop 4.84.0 (July 27) fixes a hang triggered by an invalid `~/.docker/config.json`, a credential-management flaw where deleting an unrelated credential ID could erase Docker Hub OAuth tokens, and Windows installer/uninstaller reliability issues.

Cloudflare Workers

Workers Builds now defaults to Node.js 24.18.0 (July 30), with 22.23.2 still available via override. Cloudflare also doubled Workers Builds CPU allocation on paid plans (2 to 4 vCPU) and shipped `wrangler check startup` for profiling cold-start bundle size and CPU.

Vercel

Several changelog entries landed July 31 to August 2: Vercel MCP now supports the 2026-07-28 MCP specification with a hardened auth model, AI Gateway added team and project spend budgets with alerts at 50/75/100% of budget, and a new AI Gateway logging dashboard shipped for request-level visibility.

Podman

Podman 6.0.2 (July 22) fixes WSL VM cleanup on failed `machine init` and a Windows multi-user installer PATH bug. The 6.1.0-RC1 preview (July 31) adds `podman volume rename`, `podman machine restart`, and `--retry`/`--retry-delay` flags on `manifest push`.

Railway & Render

Railway shipped an official ChatGPT plugin for provisioning and deploying infrastructure from a chat conversation, six new Observability dashboard panels, and — notably — made its four core database templates (Postgres, MySQL, MongoDB, Redis) private-by-default with no public TCP proxy. Render expanded managed OIDC authentication to support Anthropic and OpenAI as providers, removing the need to store long-lived API keys.

Quiet this cycle

Docker Compose (latest is v5.3.1, July 7), Kubernetes (next patch batch isn't due until v1.37.0 on August 26), and AWS had no dated release or advisory inside the research window.

Identity & Authentication (IAM)

Keycloak 26.7.0 (July 9) introduced a SCIM API for automated user/group provisioning and simplified multi-cluster High Availability via direct Infinispan cache replication.

Authentik 2026.5.6 (July 22) is a patch release fixing SCIM provider group-member removal, PostgreSQL stale-connection handling, and per-IP rate-throttling accuracy.

Clerk shipped self-serve SSO for OIDC (July 30) — customer IT admins can now configure OpenID Connect enterprise connections themselves via `<OrganizationProfile />`, without developer involvement.

Auth0 landed several dashboard and platform features between July 29–31: Global Search (Cmd+K) reached general availability, "Enterprise Connect" beta lets Auth0 federate existing SAML/OIDC identity providers, Curated Blocklists (TOR exit nodes, low-reputation IPs) reached GA, and an early-access "Agents as Principal" feature gives AI agents distinct identities separate from human users. See the Auth0 changelog for details.

Better Auth 1.6.25 (July 23) fixes Apple OAuth not sending the PKCE code challenge — which broke token exchange — and Google One Tap creating accounts even when sign-up was disabled on the provider.

`next-auth` 4.24.15 (July 20) changed `getToken()` to return `null` instead of throwing on a malformed Bearer header; separately, the Auth.js project is now maintained going forward by the Better Auth team.

Meta-Frameworks & Core Web Standards

Next.js — three High-severity CVEs

The July 2026 Security Release fixes nine CVEs across App Router. The three rated High severity:

• CVE-2026-64641 — crafted requests to a Server Action can cause excessive CPU usage, blocking further requests in the same process (DoS).
• CVE-2026-64642 — apps built with Turbopack and a single `config.i18n.locales` entry can have their middleware/proxy bypassed entirely.
• CVE-2026-64645 — a `rewrites()`/`redirects()` rule built from request-controlled input can be pointed at an arbitrary hostname, enabling SSRF or open redirect.

Six further Medium-severity issues were also patched, covering Server Action SSRF on custom servers, SVG-based DoS in the Image Optimization API, unbounded Edge Server Action payloads, endpoint-ID disclosure, and two `fetch` cache-confusion bugs.

npm install [email protected]  # for the 15.5 line
npm install [email protected]  # for the 16.2 line

Nuxt — a Critical DevTools RCE

Nuxt 4.5.1 / 3.21.10 (July 27) fixes three advisories:

• GHSA-279x-mwfv-vcqv (Critical, CVSS 9.6) — an unauthenticated, bidirectional RPC channel in Nuxt DevTools operates over the Vite HMR WebSocket with no token, handshake, or origin check, letting any reachable client chain `updateOptions()` and `openInEditor()` into arbitrary command execution on the developer's machine. Fixed in `@nuxt/devtools` 3.3.1.
• GHSA-9473-5f9j-94wq (High, CVSS 8.1) — server-side RCE via runtime template injection in Server Island props when `vue.runtimeCompiler: true` is set.
• GHSA-hxvh-4h3w-prp9 (High, CVSS 8.2) — an incomplete fix for a prior CVE where mixed-case route-rule keys silently bypassed `appMiddleware` auth gates.

The Nuxt team recommends `npx nuxt upgrade --dedupe` and purging any cached `_payload.json` from CDNs after upgrading.

React, Vue, SvelteKit, Svelte, Astro

React 19.2.8 / 19.1.9 / 19.0.8 (July 21) are patch releases improving RSC payload decoding performance. Note the canonical repo has moved to `github.com/react/react`.

Vue shipped a routine patch, 3.5.40 (July 16), alongside the second release candidate for Vue 3.6, which focuses on bug fixes for Vapor Mode ahead of stabilization.

SvelteKit 2.70.2 (July 29) fixes a ReDoS-style backtracking issue in `Accept` header content negotiation. In parallel, SvelteKit 3 preview releases (`3.0.0-next.13`) introduced `$app/manifest` and `$app/service-worker` modules and shallow routing built into `goto`.

Svelte 5.56.8 (July 24) fixes incorrect `onerror`/`reset` behavior when hydrating a failed error boundary.

Astro 7.1.6 (July 29) fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes.

Backend Frameworks & Runtimes

Node.js security release

Node.js 26.5.1 / 24.18.1 / 22.23.2 (July 29) fix 11 CVEs. The High-severity issues: CVE-2026-56846 (HTTP/2 header retention bypasses `maxSessionMemory`), CVE-2026-56848 (HTTP/2 re-entrant send heap-use-after-free), and CVE-2026-58043 (Permission Model over-grants filesystem access). Medium/Low issues touch the HTTPS Agent, `node:sqlite`, `dns.resolveAny`, `node:zlib`, and the HTTP parser (request smuggling via header truncation).

Hono — four fresh advisories

Hono 4.12.34 (August 3) closes four advisories published the same day on the Hono security advisories page:

• GHSA-8j4g-w8fx-2239 (Moderate) — ReDoS in the CORS middleware via `Access-Control-Request-Headers`.
• GHSA-f23p-vx2j-j53r (Moderate) — `memo()` retains SSR output across requests, causing cross-user data disclosure.
• GHSA-54fx-42gc-7vw4 (Moderate) — algorithmic-complexity DoS in Language Middleware.
• GHSA-79qm-7rj5-m7r9 (Low) — the Proxy Helper doesn't strip response headers listed in `Connection`.

Fastify, FastAPI, Laravel, Django

Fastify 5.11.0 (July 30) adds RFC 10008 HTTP QUERY method support and improves response serialization by reusing cached content types.

FastAPI 0.141.1 (July 29) fixes background-task and header propagation from dependencies used in the new `app.frontend()` helper introduced in 0.141.0.

Laravel 13.23.0 (July 27) adds a monthly log rotation driver, SES tenant support for the SES v2 mail transport, and switches the maintenance-mode bypass secret check to a timing-safe comparison.

Django 6.1 reached release candidate 1 (July 22), marking the string freeze ahead of a stable release targeted for early August.

Quiet this cycle

NestJS (latest v11.1.28, July 8), Express (latest v5.2.1, unchanged since December), and ElysiaJS (latest 1.4.29, mid-June) had no new tagged release inside the window.

UI Systems, Styling & Motion

shadcn/ui's CLI reached v4.16.1 (July 31) with "Dynamic Search" — registries can now handle search server-side instead of requiring the CLI to download the whole catalog. Base UI also became the default component base for new projects, with Radix still fully supported via `shadcn init -b radix`.

Radix UI 1.6.7 / `@radix-ui/react-dialog` 1.1.23 (July 24) fixes broken ARIA refs in Dialog, `onValueCommit` not firing on Slider, and Escape removing non-focused Toasts. Per-primitive subpath entry points were also added for better tree-shaking.

Motion 12.43.0 (July 27) adds hardware acceleration for `backgroundColor` animations and fixes an `AnimatePresence` bug where exiting and entering children could interleave out of order.

Tailwind CSS's latest stable remains v4.3.3 (July 16), which added `--watch --poll[=ms]` to the CLI for unreliable filesystems. Material UI is quiet this cycle — latest is v9.2.0 from July 3.

Databases, Caching & Vector Search

PostgreSQL 19 Beta 2 (July 16) freezes the feature set ahead of a GA targeted for September/October, headlined by native SQL/PGQ graph queries and a unified `REPACK` command for zero-downtime table reorganization.

pgvector 0.8.6 (July 29) fixes a buffer overflow in IVFFlat index builds on 32-bit systems and excess memory usage during IVFFlat index scans in nested loop joins.

Redis 8.10-RC2 (July 20) is a pre-release fixing a bug where a client could manipulate data read by a connection by injecting `\r\n` sequences into an error reply. Redis 8.10 overall introduces "compact hashes," a new encoding that shares field names across keys with a common schema.

MongoDB Server 8.0.28 (July 22) is a security and reliability patch fixing CVE-2026-9737 and a range of CVE-2026-130xx issues, including FLE2 contention-factor limits and a `mongos` `killCursors` authorization check. Companion fixes shipped in 7.0.39, 8.2.12, and 8.3.7.

ClickHouse 26.7 (July 22) ships a backward-incompatible security change: S3 access from user SQL no longer resolves the server's own cloud credentials by default.

-- ClickHouse 26.7+: explicit credentials or NOSIGN are now required
-- for user SQL to access S3, unless this is re-enabled:
SET s3_allow_server_credentials_in_user_queries = 1;

DuckDB 1.5.5 (July 22) fixes swapped min/max stats with multi-row-group 128-bit `DECIMAL` columns and adds guards against exceptions in `DICT_FSST` compression with small block sizes.

Database Tools, ORMs & BaaS

Prisma ORM 7.9.0 / 7.9.1 (July 20/27) adds shell tab-completions and an AI-safety checkpoint that blocks destructive commands when an AI coding agent is detected, unless the user explicitly consents.

Supabase is landing several breaking platform changes: self-hosted deployments switch their default API gateway from Kong to Envoy the week of August 9 (hosted Cloud is unaffected), explicit Postgres extension version pinning is deprecated from August 5, and the `realtime` schema is now fully locked against create/alter/drop operations. See the Supabase changelog for the full list. Separately, supabase-js 2.111.0 (July 28) fixes overlapping auth flows clobbering each other's PKCE verifiers.

Firebase JS SDK 12.17.0 (July 30) improves error messaging for duplicate `initializeApp()` calls and deprecates `VertexAIBackend` in favor of `AgentPlatformBackend`.

Drizzle ORM is quiet this cycle — the npm `latest` tag remains 0.45.2, with the 1.0 line still at release candidate 4.

Background Jobs, Messaging & Task Queues

BullMQ v6 — breaking changes

BullMQ 6.0.0 (July 30, patched through 6.0.6 by August 3) introduces a pluggable queue-backend abstraction (`IQueueBackend`), adding PostgreSQL as an alternative to Redis. Breaking changes:

• `Queue#client`, `Worker#blockingClient`, and `FlowProducer#client` are removed — use `getBackend()` instead.
• Legacy `repeat`-based repeatable jobs are removed in favor of Job Schedulers.
• `Worker#resume()` is now async.
• Minimum supported Node.js is now 14.17.0.

RabbitMQ 4.3.4 / 4.2.9 (July 20–23) raise the minimum supported Erlang/OTP version to 27.0 — nodes on Erlang/OTP 26 will fail to start after upgrading. The releases also fix quorum-queue metrics after upgrades, tighten AMQP 1.0 parser permission checks, and drop `unsafe-eval`/`unsafe-inline` from the management UI's CSP.

Quiet this cycle

Apache Kafka (latest 4.3.1, June 25) and Temporal (latest server release v1.31.2, July 8) had no dated release inside the research window.

What to Patch First

If you only have time for three upgrades today: patch Next.js to 16.2.11/15.5.21, patch Nuxt to 4.5.1/3.21.10 and rotate any exposed DevTools access, and patch Node.js to the latest 26.x/24.x/22.x release. All three close remotely-reachable High-or-Critical severity issues disclosed in the last two weeks.