Sep 14 Release Watch: MongoDB CVEs & Cloudflare RCE

This cycle's dev-stack sweep is led by database security rather than frameworks: MongoDB closed out a run of CVEs including one rated 9.2, Cloudflare pushed an emergency WAF rule for an actively-exploited Adobe Commerce RCE, and Docker Desktop closed two more CVEs of its own. Frameworks and tooling kept shipping in the background. Here's the breakdown.

Executive Summary

• MongoDB: five CVEs patched across three batches (Sept 8–11), the worst rated CVSS 9.2; upgrade to 8.3.11, 8.3.9, 8.0.30, or 7.0.41 depending on your line.
• Cloudflare: shipped an emergency WAF rule on September 10 for CVE-2026-75650 ("StyleSmuggler"), an actively-exploited unauthenticated RCE in Adobe Commerce via template injection.
• Docker Desktop 4.90.0 (Sept 7) fixes CVE-2026-46595 and CVE-2026-39834 in the bundled Kind cloud-provider image, plus a sync-file-share regression breaking mmap/git/pnpm.
• React 19.3.0 (Sept 9) stabilizes View Transitions and Fragment Refs; Next.js 16.3.5 (Sept 11) adds CSP nonce support for script tags.
• Laravel v13.31.0, Better Auth 1.7.4, Prisma 8.0.0-rc.14, and BullMQ 6.3.5 all shipped this week; RabbitMQ and Temporal both carry open advisories worth reviewing.

MongoDB: Five CVEs Patched Across Three Batches

MongoDB's advisory feed was the busiest security channel this cycle. The most severe batch landed September 8: CVE-2026-82067, CVE-2026-82075, CVE-2026-82064, and CVE-2026-82074 carry CVSS scores up to 9.2 and are fixed in server versions 8.3.9, 8.0.30, and 7.0.41.

On September 10, a separate set of GridFS query-injection CVEs (CVE-2026-88036, -88034, -88033, -88029, -88030) shipped across the C, C++, Java, Python, and Ruby drivers, alongside CVE-2026-88032 (CVSS 8.2 denial-of-service in reactive CSFLE) and CVE-2026-88035 (heap overflow in the C driver). September 11 closed the window with CVE-2026-89099 (CVSS 7.7, a race condition and memory corruption issue in the document value layer), fixed in server 8.3.11.

If you're running a self-managed cluster, the practical takeaway is to check your driver version separately from your server version — this batch touched both layers, and the driver-side GridFS fixes are easy to miss if you only track server release notes.

Cloudflare: Emergency WAF Rule for an Actively-Exploited Adobe Commerce RCE

On September 10, Cloudflare pushed an emergency managed WAF rule covering CVE-2026-75650, nicknamed "StyleSmuggler" — an unauthenticated remote code execution vulnerability in Adobe Commerce reachable through template injection, and already under active exploitation at disclosure. Sites behind Cloudflare's managed ruleset picked up the mitigation automatically; anyone running Adobe Commerce or Magento outside Cloudflare's edge should prioritize the vendor patch rather than relying on WAF coverage alone.

Docker Desktop 4.90.0: Two CVEs Closed

Docker Desktop 4.90.0 shipped September 7 bundling Docker Agent v1.128.0. The security-relevant change updates the bundled Kind cloud-provider image to address CVE-2026-46595 and CVE-2026-39834. The same release also fixes a regression where mmap()-based tools — including git and pnpm — broke on synced file shares.

Frameworks: React 19.3 Goes Stable, Next.js and Vue Tick Forward

• React 19.3.0 (Sept 9) promotes View Transitions and Fragment Refs from experimental to stable, and adds a new browser() API along with Trusted Types support.
• Next.js 16.3.5 (Sept 11, patch release) adds CSP nonce support to injected script tags and fixes a zero-byte image-cache entry bug plus standalone-output file-tracing emission.
• Vue's 3.6 line reached release candidate 3.6.0-rc.8 on September 11; it's still pre-release, so pin to 3.5 for production until the stable tag lands.

Backend & Tooling: Laravel, Better Auth, Prisma, Firebase, BullMQ

• Laravel v13.31.0 (Sept 8) fixes queue and Redis cluster-safety issues, corrects an auth hash-validation bug, and patches Eloquent's lazy() and soft-delete behavior.
• Better Auth 1.7.4 and 1.6.31 (Sept 10) add OpenTelemetry span control and Vitest 5 support, and fix an Expo SecureStore bug.
• Prisma reached 8.0.0-rc.14 (Sept 12) with CLI fixes: a pinned composer-cli version to stop install hangs, and a capped conformance-sandbox install step.
• Firebase Admin SDK 14.4.0 (Sept 10) ships Firebase ML deprecation notices alongside Firestore and Cloud Storage dependency updates.
• Node.js 26.8.2 (Current) and 24.21.0 (LTS) shipped Sept 9; Fastify 5.12.4 (Sept 11) fixes a version-mismatch bug in the fastify.js entrypoint; BullMQ 6.3.5 (Sept 14) bumps cron-parser to v5.10.1 for a scheduling bug fix.

Messaging & Data Infra: Open Advisories on RabbitMQ and Temporal

Two advisories are worth checking against your deployment rather than filing away. RabbitMQ carries CVE-2026-67418 (low severity — malformed MQTT 5.0 PUBLISH properties incorrectly disconnect subscribers) plus a high-severity routing denial-of-service advisory where consecutive topic wildcards create combinatorial routing cost; both predate this week but remain unpatched in the current 4.3.5 stable line.

Temporal disclosed CVE-2026-5724 (CVSS 6.3, medium) — the AdminService/StreamWorkflowReplicationMessages gRPC streaming endpoint was missing authentication, allowing unauthenticated access to replication streams. It's fixed in server 1.28.4, 1.29.6, 1.30.4, 1.31.2, and 1.32.0 and later; anyone running self-hosted Temporal should confirm their server build against that list.

On the quieter end, ClickHouse shipped routine bugfix builds on September 13 (26.8.3.105-lts, 26.7.7.92-stable, 26.6.5.120-stable) with no security content.

# Laravel: bump the framework and clear the config cache
composer update laravel/framework
php artisan config:clear
php artisan queue:restart

Infra: Vercel Sandbox Doubles, Railway Adds One-Click Postgres Upgrades

Vercel doubled default Sandbox storage to 64 GB (Sept 11) and added access-control restrictions to Connect for Pro/Enterprise teams. Railway shipped one-click major-version Postgres upgrades and email forwarding for Railway domains on Sept 11.

Also Tracking: No Material Change This Cycle

The rest of today's watchlist held steady, shipped just outside the September 10–14 window, or had nothing new in official channels as of publication: Keycloak (CVE-2026-82968 from last cycle remains unpatched upstream); Kubernetes (latest is 1.37.0, Aug 26); Authentik 2026.8 (Sept 1); Clerk (OAuth Device Authorization Grant beta, Sept 8) and Auth0 (new Deny All tenant rule, Sept 8); shadcn/ui 4.21.0 (Sept 4, centralized cn package) and Motion 13.2.0 (Sept 2); Tailwind CSS (4.3.3, July), Radix UI (1.6.7, July), and Material UI (9.4.0, Aug 27); PostgreSQL (latest Aug 13), Redis (CVE-2026-81934 fix already shipped early Sept), and DuckDB (1.5.5, July); Supabase (supabase-js 2.116.0, Sept 7) and Drizzle ORM (stable unchanged; 1.0.0-rc.5 pre-release, Sept 9); Apache Kafka (latest 4.3.1, June); Astro 7.3.2 (Sept 8) and SvelteKit (3.0.0-next.27 pre-release, Sept 8); NestJS (12.0.1, Aug 27), Express (4.22.2, May), Hono (4.13.7, Sept 4), and ElysiaJS (2.0.0-beta.14, Sept 7); FastAPI (0.141.1, July) and Django (6.1.1, Sept 2, no new fix this cycle).

We'll cover any of these the moment they publish a dated release note, advisory, or CVE — this roundup only reports changes verified against an official source, not scheduled or speculative ones.