Dev Release Radar — September 7, 2026: PostgreSQL Patches a Record 28 CVEs as Keycloak and Next.js Fix Critical RCEs

This week's stack-wide audit turned up the largest security release in PostgreSQL's history, a critical unauthenticated bypass in Keycloak's password-reset flow, and a fresh critical RCE patched in Next.js — alongside a steady run of new releases from Fastify, Hono, Astro, Vue, BullMQ, and more. Here's what changed across containers, identity, frameworks, databases, and messaging infrastructure this week, and what to patch first.

Executive Summary

• PostgreSQL 18.6/17.11/16.15/15.19/14.24 (Aug 13, 2026) fixed 28 CVEs in one release — the most in the project's history, including two CVSS 8.8 heap buffer overflows that allow arbitrary code execution.
• Keycloak 26.7.2 fixed CVE-2026-18963 (CVSS 9.1), an unauthenticated account-takeover bug in the reset-credentials flow — any instance below 26.7.2 is exploitable without user interaction.
• Next.js 16.3.3 / 15.5.24 shipped two critical unauthenticated RCE fixes; Nuxt 4.5.1 / 3.21.10 separately fixed a server-side RCE via Server Island props.
• Redis fixed a TLS use-after-free (CVE-2026-81934) and RabbitMQ fixed an OAuth-secret-leak bug (CVE-2026-57219) that let unauthenticated attackers take over a broker.
• Docker and Podman both shipped fixes for a shared tar-extraction path-traversal flaw in moby/go-archive (CVE-2026-17106).
• Fresh releases landed this week from Fastify (5.12.3), Hono (4.13.7), Astro (7.3.1), Vue (3.6.0-rc.7), BullMQ (6.3.4), and Cloudflare Workers (64 MiB bundle limit).

Critical Security Patches You Should Apply Now

PostgreSQL: the biggest CVE batch yet

On August 13, 2026 the PostgreSQL team shipped 18.6, 17.11, 16.15, 15.19, and 14.24 (plus 19 Beta 3), fixing 28 CVEs in a single release — more than any prior PostgreSQL security release. The headline issues are two CVSS 8.8 heap buffer overflows: CVE-2026-14664 in regexp match/split functions and CVE-2026-14669 in to_char, both of which let a user who can run arbitrary SQL execute code as the OS user running the database. A third, CVE-2026-19385, affects pg_dump. If you run any supported PostgreSQL branch, this is a same-day upgrade.

apt-get install --only-upgrade postgresql-17
# or
docker pull postgres:17.11

Sources: PostgreSQL 18.6 release announcement, CVE-2026-14664 advisory

Keycloak: unauthenticated account takeover

CVE-2026-18963 (CVSS 9.1) is a state-validation bug in Keycloak's reset-credentials flow: an unauthenticated attacker can force a password reset for any user without clicking the email verification link, then set new credentials directly. Affected versions run from 26.0.0 up to (but not including) 26.4.15, 26.6.6, and 26.7.2. If you can't patch immediately, Red Hat's advisory notes that disabling password reset realm-wide is an effective, if disruptive, mitigation.

Sources: The Hacker News writeup, Red Hat CVE-2026-18963

Next.js and Nuxt: two more critical RCEs

Next.js's August 2026 security release (15.5.24 LTS / 16.3.3) fixed two critical, unauthenticated RCE bugs: CVE-2026-75604 (CVSS 9.0), which affects self-hosted apps mixing the Pages Router and App Router on Windows, and a second flaw in AVIF image optimization inherited from an underlying image library. Vercel's managed platform was never affected; self-hosted deployments should update immediately — a public proof-of-concept surfaced within about 24 hours of disclosure.

Separately, Nuxt shipped 4.5.1 / 3.21.10 for CVE-2026-71320 (CVSS 8.1): with vue.runtimeCompiler: true enabled, a Server Island component that forwards props into Vue's dynamic <component :is> resolution can be tricked into compiling and executing an attacker-supplied template server-side. @nuxt/ui's as/asChild prop pattern is a common exposure path.

Sources: Next.js August 2026 security release, Nuxt advisory GHSA-48hr-524c-v5w3

Redis, RabbitMQ, and the shared Docker/Podman tar bug

Redis's TLS builds got a fix for CVE-2026-81934, a use-after-free in tlsProcessPendingData() that a connected client could trigger to potentially execute arbitrary code; fixed in 8.10.1, 8.8.2, 8.6.6, 8.4.6, and 8.2.9.

RabbitMQ fixed CVE-2026-57219 (CVSS 8.7): an unauthenticated GET /api/auth endpoint on OAuth-configured brokers leaked the OAuth client secret, which could be exchanged for an admin token and full broker control. Fixed in 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

And a shared dependency, moby/go-archive, had a tar-extraction path-traversal bug (CVE-2026-17106) that let a crafted archive write files outside the intended extraction directory — affecting both Docker (fixed in Engine 29.7.0) and Podman (fixed in 6.1.1).

Sources: Redis security advisory, RabbitMQ OAuth flaw coverage, moby/go-archive advisory

Also worth a patch cycle

Node.js's July 29 security release (22.23.2 / 24.18.1 / 26.5.1) fixed 12 CVEs including an HTTP/2 use-after-free (CVE-2026-56848); Django's August 4 release fixed 4 CVEs including an SSRF/file-write via spatial lookups (CVE-2026-15307); and pgvector 0.8.2 closed a parallel-HNSW buffer overflow (CVE-2026-3172) that could leak data across relations.

Sources: Node.js July 2026 security releases, Django security releases archive

Fresh Releases This Week (Sep 1–7)

Containers & edge

• Docker shipped Engine 29.8.0, Compose 5.5.1, and Desktop 4.89.0 (Sept 1–3), adding HostConfig.Umask, AppArmor/SELinux rules blocking containers from reaching the host over AF_VSOCK, and bundling NVIDIA Container Toolkit 1.20.0. (Docker Engine release notes)
• Cloudflare Workers raised the uncompressed bundle-size limit to 64 MiB on all plans and shipped WSGI/ASGI support for Python Workers, so Django and Flask apps can now run natively at the edge. (Cloudflare changelog)
• Vercel added support for running Cursor Cloud Agents inside Vercel Sandbox's scale-to-zero microVMs and introduced Basic build machines for Pro/Enterprise plans. (Vercel changelog)
• Railway's CLI picked up Postgres management, variable editing, and agent connections; Render shipped a new Deploys page with rollout history and a usage-billed "flex" compute plan. (Railway changelog, Render changelog)

Identity

Authentik released 2026.8.1, a routine patch release. Auth0 moved Advanced MFA Configuration to GA and opened Early Access for self-service third-party app access. (Auth0 changelog)

Meta-frameworks

Astro 7.3.1 landed a startup-error fix for astro:assets, following 7.3.0's new --ignore-lock preview flag. Vue pushed 3.6.0-rc.7 as Vapor Mode nears feature parity with the virtual DOM renderer. SvelteKit's 3.0 line continues pre-releasing (3.0.0-next.25) with a new applyReroute adapter helper. (Astro releases, Vue core releases)

Backend

Fastify hit 5.12.3 and Hono hit 4.13.7 this week, both continuing a cadence of frequent patch releases following earlier 2026 CVEs in @fastify/static and hono/jsx SSR. NestJS's new v12 line (12.0.1) added native Standard Schema support, so @Body()/@Query() decorators now accept Zod or Valibot schemas directly. Laravel shipped its usual weekly drop (13.30.1 / 12.69.1) with whereBinary() and a new Cloud facade. (NestJS releases, Laravel framework on Packagist)

UI & data

shadcn's CLI hit 4.21.0 and Motion (formerly Framer Motion) shipped 13.2.0. MUI jumped straight from v7 to v9, skipping v8 entirely, in a coordinated Material UI + MUI X release that drops deprecated component/componentsProps props — a breaking change worth budgeting migration time for. BullMQ 6.3.4 continues rolling out its new IQueueBackend abstraction, and Prisma's 8.0.0-rc.13 release candidate is active ahead of a stable v8. (MUI v9 announcement, BullMQ changelog)

What to Do Next

If you run PostgreSQL, Keycloak, Next.js (self-hosted), Nuxt, Redis, RabbitMQ, Docker, or Podman, treat this week's advisories as a priority patch cycle — several are unauthenticated and remotely exploitable. Everything else above is routine feature and maintenance work you can fold into your normal upgrade cadence.