Critical Security Patches Hit Next.js, Docker, Keycloak

This is the September 1, 2026 edition of our daily release audit across the modern development stack — containers and edge platforms, identity providers, meta-frameworks, backend runtimes, UI systems, databases, and messaging infrastructure. The dominant theme this week is security: five widely-used projects (Next.js, Docker Desktop, Keycloak, PostgreSQL, and Redis) shipped patches for remotely exploitable vulnerabilities in the last seven days. Below is a category-by-category breakdown with verified links to every release note, advisory, and CVE record referenced.

Executive Summary

• Next.js v16.3.3 / v15.5.24 patch an unauthenticated RCE reachable through AVIF image optimization and a Windows-specific path-traversal RCE (CVE-2026-75604). Upgrade immediately if you self-host Next.js image optimization.
• Docker Desktop patched CVE-2026-8936, an unbounded-recursion panic in the grpcfuse kernel module that could crash the Desktop VM.
• Keycloak 26.7.3 is a security-only release fixing 20 CVEs spanning LDAP, OIDC, SAML, and fine-grained admin permissions — treat this as a mandatory upgrade for any IAM deployment.
• PostgreSQL 18.6/17.11/16.15/15.19/14.24 closed 28 CVEs, including a SQL-injection vector via EXTRACT-expression deparsing and a psql arbitrary-code-execution bug in \unrestrict.
• Redis disclosed CVE-2026-81934, a use-after-free in TLS pending-data processing; fixed builds were already shipped August 17 ahead of the public advisory.
• NestJS v12 completed a full ESM migration for all core packages — plan CommonJS compatibility testing before upgrading.
• ClickHouse 26.8 opened a new LTS line carrying dozens of breaking changes since 26.3 LTS.

Containers, Edge & Infrastructure

Docker

Docker Engine v29.7.2 (Aug 5) fixed a service-create panic on duplicate environment variables, a regression that rejected image pulls containing absolute hardlink targets, and bumped BuildKit to v0.32.2. Separately, Docker Desktop's August build cycle shipped a fix for CVE-2026-8936 (Docker security announcements), an unbounded-recursion panic in the grpcfuse kernel module, alongside new Model Runner registry-mirror support.

docker version --format '{{.Server.Version}}'
# confirm you're on Engine 29.7.2+ / Desktop's latest August build

Cloudflare

• R2 US jurisdiction (Aug 17) guarantees bucket data is stored and processed only within the United States.
• Durable Objects (Aug 28) raised the dynamic Workers concurrency limit from 4 to 10.
• Workers AI + AI Gateway (Aug 7) unified billing and model access across both products.

Vercel & Next.js Hosting

Beyond the Next.js security release covered above, Vercel's August platform update (Aug 31) took the Security Dashboard and Vercel Connect to general availability — Connect replaces long-lived provider secrets with short-lived scoped tokens across 100+ service integrations — and introduced a Run SDK for sandboxed agent code execution with human approval gates.

Kubernetes & Podman

Kubernetes v1.34 entered maintenance mode on August 27, 2026 (EOL October 27); v1.35 "Timbernetes" remains the current stable minor. Podman v6.1.0 added podman volume rename, podman machine restart, podman network rm --ignore, retry options for podman manifest push, and a new Quadlet ImageVolume= key.

Cloud Platforms

• AWS's weekly roundup (Aug 31) announced a definitive agreement to acquire DuckLabs, creator of DuckDB, plus Agentic Resource Discovery (ARD), an open spec for agent/tool/MCP-server discovery across clouds.
• Railway changelog #0304 (Aug 20) expanded Cloud Agents and Edge Rules and began deprecating Config-as-Code in favor of a new IaC SDK as of Aug 28.
• Render (Aug 26) shipped memory-optimized compute tiers with spec-based plan IDs (e.g. 4c-32g), following a build-infrastructure upgrade that cut median build time ~40%.

Identity & Authentication

Keycloak 26.7.3 (Aug 31) is a security-only release patching 20 CVEs across LDAP, OIDC, SAML, fine-grained admin permissions, and token exchange, plus 14 bug fixes. Authentik 2026.8.0 (Aug 18) added Enterprise PAM requests, agent/service accounts, and a Rust rewrite of the proxy outpost — note the breaking change: the hash_password management command no longer accepts passwords as CLI arguments.

# Keycloak upgrade check
bin/kc.sh show-config | grep 'kc.version'
# then follow the 26.7.3 upgrade guide before restarting the realm

• Clerk (Aug 28) let admins customize the reverification/step-up window (1–10 minutes) for sensitive actions, following an Admin Logs audit trail feature (Aug 25).
• Auth0 (Aug 31) opened Early Access for Cross-App Access Requesting App, letting apps obtain third-party API tokens via Auth0's Token Vault without manual account linking.
• Better Auth v1.7.2 (Aug 26) fixed permanent-ban expiration handling and cookie-cache signed-session validation — teams still on older releases should also confirm they've picked up July's fix for GHSA-qq9h-g4jm-xgf3, an account-takeover path via magic-link/email-OTP sign-in.
• Auth.js / NextAuth had no release in the last week, but if you haven't upgraded past the July 20 patch cycle, four real advisories remain unfixed on older versions — including GHSA-x445-f3h2-j279 (OAuth state/nonce/PKCE cookies not bound to the originating provider).

Meta-Frameworks & Core Web Standards

Next.js's August 25 security release fixed two critical, unauthenticated RCEs: one via crafted AVIF input in Image Optimization (rooted in the upstream libheif dependency), and a Windows-specific path-traversal RCE tracked as CVE-2026-75604. Fixes landed in v16.3.3 and the v15.5.24 maintenance LTS; a same-week follow-up (v16.3.4, Aug 31) re-enabled AVIF optimization once the upstream fix was confirmed and backported Turbopack manifest fixes. Vercel-hosted apps were auto-protected; self-hosted deployments need a manual upgrade.

npm install [email protected]
# or for the maintenance LTS line:
npm install [email protected]

• Vue.js cut v3.5.42 (Aug 27) while the v3.6.0-rc.6 prerelease (Aug 28) continues previewing Vapor Mode, an opt-in compilation strategy that reduces bundle size and improves runtime performance.
• Svelte 5.57.0 (Aug 28) exported new server-rendering types (RenderOutput, Csp) and added a has() method to createContext.
• Astro 7.2.10 (Aug 31) fixed a runtime crash from a minified SSR manifest and incorrect sitemap URLs under trailingSlash: "never"; companion releases shipped for @astrojs/[email protected] and @astrojs/[email protected].
• SvelteKit (@sveltejs/[email protected], Aug 21) added an applyReroute helper for adapters supporting split serverless-function deployments; SvelteKit 3 is still in preview.
• Nuxt shipped no update this week, but v4.5.2 (Aug 5) is the minimum safe version — the prior v4.5.1 (Jul 27) fixed a server-side RCE via server island props and a route-rule authorization bypass.
• React — no update this week; v19.2.8 (Jul 21) remains current, with Server Components decoding performance improvements.

Backend Frameworks & Runtimes

NestJS v12.0.0 (Aug 27) is a major release: full ESM migration across all core packages (CommonJS still works via require(esm)), native Standard Schema support for Zod/Valibot/ArkType in decorators and pipes, a new @nestjs/observe observability SDK, and a rebuilt CLI defaulting to Rspack and Vitest for ESM projects. Requires Node.js v20.19+ or v22.12+.

• Hono v4.13.5 (Aug 26) shipped three security fixes: a query-parser fragment-handling bug that could cause cache-key/proxy mismatches, an incomplete toSSG() path-traversal fix, and unbounded dot-notation nesting in parseBody() that could exhaust memory.
• Laravel v13.28.0 (Aug 25) fixed MariaDB vector-distance SQL issues and added an AsVector Eloquent cast; the same-day v13.27.0 added refreshForUpdate(), whereBinary(), and a new Cloud facade.
• ElysiaJS 2.0 "Kiana" (Jul 30) introduced ahead-of-time compilation and a static-analysis engine ("Sucrose") claimed to cut startup time up to 14x and remove the old 40-routes-per-instance limit.
• Fastify v5.12.1 (~Aug 18) backported two security advisories and fixed the preClose hook to run exactly once per instance; Fastify v6 (ESM-first) is roughly 76% complete.
• Express 5.2.1 bumped body-parser to fix CVE-2026-12590, where an invalid limit option silently disabled body-size enforcement — a fail-open DoS risk.
• Django 6.0.8 / 5.2.17 (Aug 4) fixed four CVEs including a high-severity GIS raster SSRF/file-write bug and a stored-XSS issue via unvalidated URLField values in the admin.
• Node.js 26.5.1 / 24.18.1 / 22.23.2 — no update this week; the July 29 security release fixing 11 CVEs (including HTTP/2 memory exhaustion and a Permission Model bypass) remains the baseline every deployment should be on.
• FastAPI 0.141.1 — no update this week; most recently fixed SSE/JSONL streaming so status_code is no longer ignored on streaming responses.

UI Systems, Styling & Motion

• shadcn/ui CLI 4.19.1 (Aug 31) added a Questionnaire component for multi-step flows, Human in the Loop helpers for mocking paused AI SDK tool calls, and private GitHub registry support.
• Material UI 9.4.0 (Aug 27) added an opt-in theme.focusVisible token for a consistent keyboard focus ring and fixed Tooltip triggers on disabled buttons.
• Motion 13.1.1 — no update this week; the latest release guards animation window access for SSR safety and improves AnimatePresence compatibility with React 19 strict mode.
• Radix UI 1.6.7 and Tailwind CSS 4.3.3 — both quiet this week; Radix's last release reverted RSC-compatibility regressions, and Tailwind's added --watch --poll support to the CLI.

Databases, Caching & Vector Search

PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24 (Aug 13) is a coordinated security release fixing 28 CVEs and 110+ bugs, including a regexp heap buffer overflow, a to_char heap buffer overflow, SQL injection via EXTRACT-expression deparsing, and an arbitrary-code-execution bug in psql's \unrestrict command — all rated CVSS 8.1 or higher. A GIN index reltuples corruption bug also requires a manual post-upgrade check.

Redis disclosed CVE-2026-81934 on Aug 28: a use-after-free in TLS pending-data processing that could allow remote code execution by an authenticated attacker. Fixed builds (8.10.1 and backports to 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, 6.2.24) shipped Aug 17, ahead of the public writeup — there's no known active exploitation.

• ClickHouse v26.8.1 (Aug 30) opens a new LTS line with dozens of breaking changes since 26.3 LTS — notably the X-ClickHouse-Format header now explicitly governs response format and max_insert_threads defaults to auto instead of 1. Review the changelog before upgrading production clusters.
• MongoDB advisory AV26-810 (Aug 12, tracked as SERVER-130264) describes a missing SASL mechanism allow-list in intra-cluster egress connections, enabling a PLAIN-authentication downgrade and cleartext keyfile disclosure between cluster members. Patch versions: 7.0.40, 8.0.29, 8.2.13, 8.3.8.
• pgvector 0.8.6 and DuckDB v1.5.5 — both quiet this week; pgvector's last release fixed an IVFFlat index buffer overflow on 32-bit systems.

Database Tools, ORMs, BaaS & Messaging

• Prisma Compute (Aug 28) reached general availability, giving every branch its own environment with a Free plan covering 1M requests/month.
• BullMQ v6.3.3 (Aug 31) fixed Bun duplicate/reconnect job targeting, capping a chain of point releases through the week that also forwarded PostgreSQL SSL options.
• Firebase Admin Node.js SDK v14.3.0 (Aug 19) added SQL Connect features and a dedicated TOPICS_SUBSCRIPTION_RATE_EXCEEDED error code for FCM topic subscriptions.
• Supabase (Aug 21) relocated read replica management to Project Settings → Infrastructure; no API changes required.
• RabbitMQ — no update this week, but confirm you're past CVE-2026-57219 (fixed in 3.13.15 / 4.0.20 / 4.1.11 / 4.2.6), where an obsolete unauthenticated HTTP endpoint disclosed OAuth 2 client secrets.
• Apache Kafka 4.3.1 — no update this week; the current release fixed a critical Kafka Streams RocksDB native-memory leak (KAFKA-20616).
• Temporal — no update this week; confirm you're past CVE-2026-5724 (fixed in v1.28.4 / v1.29.6 / v1.30.4), a gap in the frontend gRPC authorization interceptor chain.
• Drizzle ORM v1.0.0-rc.4 — still pre-1.0-stable; latest RC expanded codec and driver support.

What to Prioritize Today

• Patch first: Next.js, Docker Desktop, Keycloak, PostgreSQL, and Redis all have active, remotely-triggerable fixes released in the last seven days.
• Plan ahead: NestJS v12's ESM migration and ClickHouse 26.8's breaking-change list both warrant a staging-environment test before production rollout.
• Watch: Vue 3.6's Vapor Mode and SvelteKit 3 remain in prerelease — worth evaluating now, not yet ready to ship.