Dev Release Radar — August 5, 2026: Django Patches a Critical SSRF/RCE Chain, Hono Closes Four CVEs

Django leads today's window with an out-of-band security release patching four CVEs — including a GDALRaster flaw that can be abused for server-side request forgery or, on vulnerable configurations, remote code execution. Hono closed four security advisories of its own, covering an SSR data leak and a CORS-middleware ReDoS bug. On the identity side, both Better Auth and Clerk shipped hardening against account-enumeration attacks, and Cloudflare pushed a WAF signature update alongside new cross-language Workers RPC. Here is everything verified from official sources across the stack between roughly August 4 and August 5, 2026.

Executive Summary

• Django 6.0.8 / 5.2.17 patches four CVEs, including CVE-2026-15307 — a GDALRaster spatial-lookup bug exploitable for SSRF or file write, and on some GeoDjango setups, RCE. Upgrade immediately if you use GeoDjango or expose the Django admin.
• Hono v4.12.34 fixes four GitHub Security Advisories, including a JSX memo()/context bug that can leak data across requests in SSR, plus a CORS-middleware ReDoS.
• Better Auth v1.6.26 stops email-OTP verification from leaking whether an address is already registered, fixes a JWT key-generation deadlock on SQLite, and switches Redis session cleanup from KEYS to SCAN to avoid blocking large keyspaces.
• Clerk's @clerk/nextjs v7.6.5 hardens the combined sign-in-or-up flow with stricter user-enumeration protection.
• Cloudflare shipped cross-language Workers RPC (Python and JavaScript Workers calling each other via service bindings) and a WAF managed-rule update adding signatures for a SharePoint RCE and a Rails vulnerability.
• BullMQ v6.0.7 and v6.0.8 follow up on last week's breaking v6.0.0 with a Redis-reconnect blocking-read fix and a Postgres-backend dependency fix.
• Laravel v13.24.0 adds Eloquent's modelKeys(), a new array_keys validation rule, and dominant-color image detection with HEIC/AVIF support.

Django 6.0.8 and 5.2.17: Four CVEs, One SSRF/RCE Risk

The Django team shipped an out-of-band security release on August 4 covering both the 6.0 and 5.2 LTS lines. The headline issue is CVE-2026-15307, a bug in GDALRaster's spatial-lookup handling that lets a crafted raster file trigger writes outside the intended directory — a path that can be escalated to SSRF, and on some GeoDjango deployments processing untrusted uploads, remote code execution. The other three are lower severity but still worth patching: CVE-2026-15337 is a denial-of-service in check_for_language() triggered by abnormally long language codes; CVE-2026-15830 is a DoS/segfault from deeply nested GEOMETRYCOLLECTION geometries; and CVE-2026-15920 is an admin-panel XSS via unvalidated URLField rendering.

If you run GeoDjango and accept user-supplied raster files, or expose the admin to anyone outside a fully trusted group, treat this as a same-day upgrade rather than a routine patch cycle.

Hono v4.12.34: Closing Four Security Advisories

Hono's v4.12.34 release fixes four GitHub Security Advisories at once. The most serious, GHSA-f23p-vx2j-j53r (CVE-2026-59896), is a JSX memo()/context bug that can leak data across requests when rendering server-side — a real risk for anyone streaming per-request state through JSX on Bun or edge runtimes. The others: GHSA-8j4g-w8fx-2239 (CVE-2026-69207), a ReDoS in the CORS middleware's handling of Access-Control-Request-Headers; GHSA-54fx-42gc-7vw4, an algorithmic-complexity DoS in the language middleware; and GHSA-79qm-7rj5-m7r9, a proxy helper that leaked connection-scoped headers.

A separate, non-security v4.13.0 shipped the same day with HTTP QUERY method support and roughly a 1.25x routing speedup.

Better Auth v1.6.26: Closing an Email-Enumeration Gap

Better Auth's v1.6.26 lands on the stable branch, after last week's 1.7 release candidate. It fixes email-OTP verification so the response no longer reveals whether an email address is already registered before the code is actually verified — a textbook enumeration leak. It also fixes a JWT key-generation deadlock on SQLite, and hardens the Redis session store by replacing listKeys()/clear() calls that used KEYS with SCAN — KEYS blocks the whole Redis instance on large keyspaces, so this closes a self-inflicted DoS risk for anyone running Better Auth at scale.

Clerk Hardens Sign-In-Or-Up Against Enumeration

Clerk's @clerk/nextjs v7.6.5 tightens the combined sign-in-or-up flow so it no longer leaks account existence through response timing or messaging differences — the same class of enumeration issue Better Auth patched this week, suggesting it's getting more attention across the identity ecosystem generally.

Cloudflare: Cross-Language Workers RPC and a WAF Signature Update

Cloudflare's changelog shows Python and JavaScript Workers can now call each other directly over RPC through service bindings, with no extra schema required — useful if you're mixing a Python data-processing Worker with a JS-facing API. Separately, the August 4 managed WAF release adds signatures for a SharePoint RCE and a Rails vulnerability plus enhanced SSRF detection, and AI Gateway picked up Access-based identity controls for per-user spend and policy limits on August 5.

BullMQ 6.0.7 and 6.0.8: Cleaning Up After the v6 Breaking Release

Two quick follow-ups to last week's breaking BullMQ v6.0.0: v6.0.7 fixes workers that could get stuck on a blocking read that never settled after a Redis reconnect, and v6.0.8 removes a deep ioredis import so the new pluggable Postgres backend no longer needs ioredis internals to run, and fails fast when its SQL loader directory can't be resolved. If you migrated to the Postgres backend when v6 shipped, both are worth picking up.

Laravel v13.24.0: Eloquent and Media Handling Improvements

Laravel's v13.24.0 is a feature release, not a security one. It adds modelKeys() to Eloquent collections, a new array_keys validation rule, dominant-color detection for images, HEIC/AVIF support, a fix for Arr::forget(), and a compatibility fix for an upcoming PHP 8.5 deprecation.

Firebase JS SDK 12.17.1: Patching a Bundling Regression

Firebase's JS SDK 12.17.1 is a small patch: it fixes a regression that unbundled peer dependencies in the standalone bundle, and aligns Data Connect's SQL stream backoff parameters. Not security-related, but worth taking if you hit bundling errors after the last minor.

SvelteKit 3.0.0-next.14: A Preview-Track Breaking Change

Worth flagging, not acting on yet: @sveltejs/[email protected] lands on the SvelteKit 3 preview line and introduces refreshAll(), which deprecates invalidateAll() and reworks client-driven refresh behavior — a breaking change, but only for teams already tracking the next tag. The stable SvelteKit line is untouched at 2.70.2.

Auth0: Advanced Filtering for Organizations Search

Auth0's changelog added advanced filtering to Organizations Search this week — filtering by name, ID, or metadata with AND/OR logic, rolling out progressively to Public Cloud tenants. A convenience feature for larger multi-org tenants, not a breaking change.

Elsewhere: No New Releases in This Window

The rest of the stack stayed quiet between August 4 and 5. No new stable release or advisory landed for Next.js, React, Vue, Nuxt, Svelte core, or Astro — Next.js and React only produced routine canary/experimental builds. Docker Engine, Kubernetes, Podman, Redis, PostgreSQL, MongoDB, ClickHouse, DuckDB, Prisma, Drizzle, Supabase, RabbitMQ, Kafka, Temporal, Tailwind CSS, MUI, Motion, Radix UI, shadcn/ui, Keycloak, Authentik, Auth.js/NextAuth, FastAPI, NestJS, Express, Fastify, ElysiaJS, and Node.js core were all checked against their official release pages and security-advisory trackers with nothing new to report today.