Dev Release Radar — September 12, 2026: Keycloak Closes 20 CVEs, Docker and Podman Patch a Container Escape

Keycloak headlined this window with a two-punch security story: a Critical account-takeover bypass in 26.7.2 followed twelve days later by 26.7.3, which closed twenty CVEs in a single release. Redis disclosed a TLS use-after-free flaw, and Docker and Podman both shipped fixes for a tar-extraction path-traversal bug that let a malicious container write files on the host. On the framework side, React 19.3 went stable with View Transitions and Fragment Refs, and Cloudflare doubled Workers' bundle-size ceiling to a flat 64 MiB. Several corners of the stack were quiet in the last two weeks — Node.js, Django, Laravel, Tailwind CSS, and Kafka had nothing newer than their last verified release, which we note explicitly below rather than padding with old news. Here is everything verified from official sources across the target stack as of September 12, 2026.

Executive Summary

• Keycloak 26.7.3 (Aug 31) closes 20 CVEs; 26.7.2 (Aug 19) patched a Critical (CVSS 9.1) unauthenticated account-takeover bypass in the reset-credentials flow.
• Redis discloses CVE-2026-81934 (Aug 28–Sep 2), a TLS use-after-free that Redis rates 7.5 High despite NVD's initial 9.8 Critical score; fixed in 8.10.1 and back-ported across six older lines.
• Docker and Podman patch CVE-2026-17106 ("CopyEscape"), a tar-extraction path-traversal letting a container write arbitrary files on the host via docker cp or a crafted tar; fixed in Docker Engine 29.7.0, Docker Desktop 4.86.0, and Podman 6.1.1.
• React 19.3 (Sep 9) ships stable with View Transitions, Fragment Refs, and a new browser() API for opting out of SSR.
• Cloudflare Workers raise the bundle-size limit to a flat 64 MiB (Sep 4) and default Python Workers to Python 3.14 (Sep 8).
• PostgreSQL's most recent security batch (Aug 13 — slightly outside this window but still current guidance) fixes a pg_dump heap buffer overflow and two other arbitrary-code-execution paths.

Identity & Authentication (IAM)

Keycloak was the standout security story of the window. 26.7.2 (Aug 19) patched CVE-2026-18963, a Critical (CVSS 9.1) bug allowing full account takeover by bypassing the reset-credentials flow without any email click required. Nine days later, 26.7.3 (Aug 31) closed twenty more CVEs in one release, including:

• CVE-2026-18209 — a redirect_uri validation bypass.
• CVE-2026-16072, CVE-2026-18201, and CVE-2026-35563 — organization- and permission-boundary bugs.
• CVE-2026-16093 and fifteen further advisories spanning token-exchange and admin-permission edge cases.

If you're running Keycloak anywhere internet-facing, upgrading to 26.7.3 should be a same-week priority.

Better Auth published v1.7.4 (npm shows it as roughly a day old as of this writing, exact release date unconfirmed) with broader Cloudflare social-login support, default schema validation at init, and password-compromise checks, alongside fixes to OAuth, session, TOTP, and Nuxt-adapter bugs.

Clerk shipped v6.15.1 (Sep 3), fixing a race condition in ticket-based sign-in/sign-up flows during Clerk's initial load.

Authentik cut 2026.8.2 (Sep 9) as a routine patch release on the 2026.8 line; a detailed changelog breakdown wasn't available at publication time.

Quiet this window: Auth0 had nothing dated in September confirmed via official channels, and Auth.js/NextAuth had no new activity to report.

Meta-Frameworks & Core Web Standards

React 19.3 (release notes, Sep 9) promotes View Transitions and Fragment Refs to stable and adds a browser() API to opt individual client-only code paths out of SSR.

Next.js 16.3.5 (Sep 11) is a routine patch — image-cache fixes, a standalone-output file-tracing fix, and CSP nonces on injected script tags. It's worth noting Next.js's most recent security release was 16.3.3 LTS / 15.5.24 on Aug 25, patching two Critical-severity issues; that's outside our strict window but still the most current Next.js security guidance if you haven't upgraded.

Svelte published its "What's New: September 2026" roundup covering 5.57, adding SvelteMap.getOrInsert/getOrInsertComputed, a has() accessor for createContext, and <select defaultValue> support. SvelteKit 3 has reached Release Candidate.

Nuxt was quiet on new releases this window, but it's worth flagging its 4.5.1/3.21.10 security batch from Jul 27 — eight advisories including a High-severity server-side RCE via server-island props and a Critical dev-only devtools RCE — if you haven't patched yet. Routine tooling update: @nuxt/test-utils v4.3.0 shipped Sep 7.

Quiet this window: Vue.js and Astro had nothing newer than their last verified release.

Backend Frameworks & Runtimes

This category was largely quiet in the last two weeks: Node.js, Fastify, Express, Hono, ElysiaJS, FastAPI, Django, and Laravel all had nothing newer than their last verified release.

NestJS shows v12.0.1 as its latest npm publish (roughly late August per package metadata, exact date unconfirmed), part of the NestJS 12 major that went ESM-first with Standard Schema support, Rspack as the default bundler, and Bun compatibility.

Containers, Edge & Infrastructure

The big infrastructure story is CVE-2026-17106 ("CopyEscape"), a path-traversal bug in the go-archive tar-extraction library shared by Docker and Podman: a malicious container or crafted tar archive could write arbitrary files on the host via docker cp or during image extraction. It's fixed in Docker Engine 29.7.0, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0, and in Podman v6.1.1 (Sep 2) — Podman 6.1.1 also fixed rootless port-bind and WSL port-forwarding regressions.

# Confirm your patched version before trusting untrusted images/containers
docker version --format '{{.Server.Version}}'   # want >= 29.7.0
podman version --format '{{.Version}}'           # want >= 6.1.1

Docker Compose followed with v5.5.1 (Sep 3), bumping compose-go to v2.15.0.

Cloudflare shipped two developer-facing changes: Workers' bundle-size limit rises to a flat 64 MiB (Sep 4), checking only uncompressed size and dropping the old 3 MB/10 MB compressed caps, and Python Workers now default to Python 3.14 (Sep 8) on any compat date from Sep 8 onward.

Vercel rolled out several Sandbox and AI Gateway changes Sep 9–10: Sandbox now runs in all compute regions with configurable region and failover, per-sandbox storage rose to 64 GB, and Tako Search went live on the AI Gateway (free through Sep 30).

Railway shipped one-click Postgres major-version upgrades and email forwarding for Railway domains (Sep 11), plus Postgres management and variable editing via the Railway CLI (Sep 4).

Render added a new Deploys page with deploy history and live-version status, plus separate Builds/Runs views for cron jobs (Sep 3), and made CLI telemetry opt-out by default starting in v2.26.0 (Sep 1).

Quiet this window: no Kubernetes security advisory has landed in the last 14 days (the most recent CVE batch dates to March/April), and no September-specific AWS security bulletin was found.

Databases, Caching & Vector Search

Redis disclosed CVE-2026-81934 (Aug 28, updated Sep 1–2): a use-after-free in TLS pending-data processing. Redis disputes NVD's initial 9.8 Critical score and assesses it as 7.5 High under CVSS v4.0, since it requires authenticated access; no active exploitation has been observed. It's fixed in 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24 — if you run TLS between Redis nodes, patch across your whole fleet, not just the newest line.

PostgreSQL's most recent security release (18.6/17.11/16.15/15.19/14.24, Aug 13 — outside our strict window but still the current guidance) is worth a callback: the headline is CVE-2026-19385, a pg_dump heap buffer overflow that can lead to arbitrary code execution, alongside CVE-2026-16239 (a cursor CLOSE+DECLARE type-confusion bug, also arbitrary-code-execution class) and three further advisories.

ClickHouse cut a routine monthly release, v26.8.2.7-lts (Sep 1), with no CVE attached.

Quiet this window: pgvector, MongoDB (whose latest confirmed stable, 8.2.3, dates back to December 2025), and DuckDB had nothing newer.

Database Tools, ORMs & BaaS

Prisma is working through v8.0.0-rc.8 (exact publish date unconfirmed, most recent dated changelog entry is the Aug 28 Prisma Compute GA announcement), which unifies configuration into a single prisma.config.ts and renames the query API's .take()/.skip() to .limit()/.offset().

Supabase resolved an operational incident — a JWT-refresh bug that was returning spurious 401s — with a fix rolling out to initial regions Sep 10 (global rollout pending). Separately, Supabase's Management API is dropping the logs.all endpoint on Sep 23 in favor of a ClickHouse-backed logs endpoint; that's upcoming, not yet in effect, but worth planning around now if you depend on it.

Firebase moved Remote Config to usage-based pricing (Sep 1): a no-cost tier up to 100k daily fetches, then pay-as-you-go on the Blaze plan beyond that.

We could not verify a current Drizzle ORM release for this window — the most recent version our search indexed (0.45.2) looked stale enough that it's more likely a search-indexing gap than genuine five-month inactivity, so we're intentionally not citing a "latest version" here rather than risk reporting outdated data as current.

Background Jobs, Messaging & Task Queues

BullMQ shipped v6.2.0 (Aug 21), introducing pluggable queue backends (Redis and Postgres). Some sources describe it as including security patches, but we could not attach a specific CVE to that claim — treat it as a stability and feature release first.

Quiet this window: RabbitMQ (latest stable 4.3.2, Jun 15) and Temporal had nothing newer confirmed. Apache Kafka 4.4.0 is planned for September per the project's release wiki, but has not shipped as of publication — don't upgrade expecting it yet.

UI Systems, Styling & Motion

Motion (formerly Framer Motion) lists v13.2.0 as its latest npm publish, roughly Sep 3 by package metadata; specific changelog contents weren't independently confirmed by publication time.

shadcn/ui had no September changelog entry; its last dated change is July's move to Base UI as the default component library (Radix remains fully supported as an alternative).

Quiet this window: Tailwind CSS, Radix UI, and Material UI had nothing newer than their last verified release.

What to Prioritize

• Patch Keycloak to 26.7.3 immediately — 26.7.2 fixes a Critical unauthenticated account-takeover bug, and 26.7.3 alone closes twenty more CVEs.
• Update Docker/Podman for CVE-2026-17106 if you run untrusted containers or pull third-party images — it's a host-filesystem write reachable via tar extraction.
• Confirm Redis is on the patched point release for your line (8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, or 6.2.24) for CVE-2026-81934, especially if you run TLS between Redis instances.
• Apply PostgreSQL's Aug 13 security batch (18.6/17.11/16.15/15.19/14.24) if you haven't — it closes a pg_dump code-execution path.
• Verify changelog sources before trusting them. Compiling this audit, we ran into a typosquatted GitHub mirror posing as containers/podman; always confirm CVE fixes against the project's org-owned repository, not the first search result.