Redis, MongoDB, Docker Fix Critical RCE Security Flaws

Executive Summary

• Redis 8.2 patches four RCE-class vulnerabilities — including a Lua use-after-free and an invalid-memory-access bug in RESTORE — plus an ACL bypass in SORT and XREAD/XREADGROUP.
• MongoDB ships 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2 fixing an intra-cluster SASL downgrade flaw (SERVER-130264) alongside nine additional CVEs.
• Docker Engine 29 closes an AuthZ-plugin authorization bypass (CVE-2026-34040) and a moby/go-archive flaw (CVE-2026-17106), plus daemon-panic and cgroup fixes for --net=host.
• Next.js closed two Critical CVEs in the August LTS release (16.3.3 / 15.5.24) and shipped a fix for CVE-2026-23869, a High-severity App Router Server Function DoS.
• PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 fixed 28 vulnerabilities in the same cycle that introduced PostgreSQL 19 Beta 3.
• Platform changes to plan around: Cloudflare D1's Workers Free daily row caps went live September 1; Supabase is retiring the logs.all Management API endpoint on September 23; Vercel now defaults new-project middleware to the Node.js runtime instead of Edge.

Docker Engine 29: AuthZ Bypass and Archive-Handling CVEs Closed

Docker Engine version 29 ships fixes for two notable CVEs: CVE-2026-34040, an authorization bypass affecting AuthZ plugins that could let a crafted request skip plugin-enforced access checks, and CVE-2026-17106, resolved by bumping github.com/moby/go-archive to v0.3.0. The release also fixes daemon panics tied to container network-interface cleanup and Swarm ingress ports, and preserves the cgroup mount for containers started with --net=host. Full details are in the official release notes.

# Confirm the daemon is on a patched build
docker version --format '{{.Server.Version}}'

# If you run third-party AuthZ plugins, audit their
# authorization decisions after upgrading to Engine 29
docker plugin ls

Next.js: Two Critical CVEs Patched, App Router DoS Flaw Fixed

Vercel's August security release pushed 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS) to address two Critical-severity vulnerabilities. Separately, CVE-2026-23869 (CVSS 7.5) affects App Router deployments using Server Functions: a crafted HTTP request to a Server Function endpoint triggers excessive CPU usage on deserialization, opening a denial-of-service path across the 13.x–16.x line. Vercel has WAF rules in front of hosted projects, but self-hosted deployments must upgrade directly. Track the fix and canary activity in the Next.js GitHub releases and the CVE-2026-23869 summary.

# Patched minimums for CVE-2026-23869
npm install next@^15.5.15   # Maintenance LTS line
npm install next@^16.2.3    # Active line and later

Redis 8.2: Four RCE-Class Vulnerabilities Patched

Redis Open Source 8.2 is marked SECURITY urgency and closes four vulnerabilities capable of remote code execution or memory corruption:

• CVE-2026-62356 — miscalculated buffer size in CMSketch RDB loading, leading to a heap out-of-bounds write.
• CVE-2026-23479 — use-after-free in the unblock-client flow, exploitable for RCE.
• CVE-2026-25243 — invalid memory access in RESTORE, exploitable for RCE.
• CVE-2026-23631 — Lua use-after-free reachable through scripting, exploitable for RCE.

The release also fixes an ACL key-permission bypass affecting SORT, GEORADIUS/GEORADIUSBYMEMBER, and XREAD/XREADGROUP — worth auditing if you rely on fine-grained ACLs. See the Redis 8.2 release notes for the complete list.

redis-server --version
# Expect: Redis server v=8.2.x or later

# If you cannot upgrade immediately, restrict
# EVAL/EVALSHA and RESTORE via ACL as a stopgap
redis-cli ACL LIST

MongoDB: Intra-Cluster Auth Downgrade and Driver CVEs

MongoDB Server 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2 fix SERVER-130264: intra-cluster SASL mechanism negotiation was missing an allow-list, letting an attacker force a downgrade to PLAIN auth and potentially disclose the cleartext keyfile. The same wave patches nine additional CVEs (CVE-2026-18688 through CVE-2026-18698), plus a driver-side fix (MongoDB Driver 5.9.2) masking the proxy password in ProxySettings logging output. Details via the Canadian Centre for Cyber Security advisory AV26-810.

PostgreSQL: Minor Releases Fix 28 CVEs, PG19 Beta 3 Ships

The same release cycle that shipped 18.6, 17.11, 16.15, 15.19, and 14.24 also fixed 28 security vulnerabilities across supported branches and delivered PostgreSQL 19 Beta 3, with general availability targeted for late September or October 2026. Teams on pgvector-heavy workloads should re-test extension compatibility before the 19.0 GA cutover. Read the PostgreSQL release announcement.

Cloudflare D1: Workers Free Plan Now Enforces Daily Row Limits

As of September 1, 2026, D1 queries on the Workers Free plan fail outright once an account exceeds its daily row-read or row-write limit — both the Workers Binding API and the REST API return errors until the limit resets at midnight UTC. Cloudflare sends an email alert when the cap is hit. Free-tier teams should add indexes to eliminate full table scans before the limit bites; anyone consistently near the ceiling should move to a Workers Paid plan. See the Cloudflare Workers changelog.

-- Identify D1 queries doing full table scans
-- before the Free-plan row caps start rejecting them
EXPLAIN QUERY PLAN
SELECT * FROM events WHERE user_id = ?;

-- Add a covering index if the plan shows SCAN instead of SEARCH
CREATE INDEX idx_events_user_id ON events(user_id);

Supabase: Envoy Replaces Kong, Logs API Migration Deadline

Self-hosted Supabase now defaults to Envoy as its API gateway instead of Kong (rolled out the week of August 9, with an opt-back-in path to Kong). More urgently, the Management API's logs.all endpoint is being removed on September 23, 2026 — any tooling or dashboards querying it need to migrate to the new ClickHouse-backed logs endpoint, which only accepts ClickHouse SQL rather than the old query format. Realtime Broadcast also gained binary (bytea) payload support over WebSockets, REST, and the database, cutting JSON overhead for sensor and image-frame streams. See the Supabase changelog.

Vercel: CLI Middleware Default Switches to Node.js

For projects created on or after September 1, 2026, Vercel's default middleware runtime changed from Edge to Node.js, with the Edge runtime now marked deprecated for new projects. The CLI also began prefixing each build-output line with a service tag during multi-service builds. This pairs with the still-relevant CVE-2026-23869 App Router Server Functions DoS covered above — worth a re-check if your middleware does authorization or rate-limiting work. See the Vercel changelog.

// vercel.json — pin the runtime explicitly if you still
// need Edge middleware after the new default flips to Node.js
{
  "functions": {
    "middleware.ts": {
      "runtime": "edge"
    }
  }
}

Prisma ORM 7.10: A Bridge to Prisma 8

Prisma ORM 7.10.0 introduces @prisma/prisma7, a compatibility package that lets a project install Prisma 8 while keeping a matching Prisma 7 CLI and config side by side — useful for staged migrations. The release also secures Prisma Studio's local server and fixes adapter bugs across PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless. Details in the Prisma changelog.

npm install @prisma/prisma7 --save-dev
# Keeps Prisma 7 CLI/config resolvable
# while prisma@8 is installed in the same project

Tailwind CSS v4.3: Native Scrollbar Styling

Tailwind CSS v4.3 adds first-party scrollbar utilities — scrollbar-auto, scrollbar-thin, scrollbar-none for scrollbar-width, plus scrollbar-thumb-* and scrollbar-track-* color utilities for scrollbar-color — along with new logical-property, zoom, and tab-size utilities and better @variant support. It folds in the earlier, unannounced v4.2 changes too. Read the Tailwind CSS blog.

<div class="h-64 overflow-y-auto scrollbar-thin scrollbar-thumb-slate-400 scrollbar-track-transparent">
  <!-- scrollable content -->
</div>

Auth.js Enters Maintenance Mode Under Better Auth

Auth.js (formerly NextAuth.js) is now maintained by the Better Auth team, and as of early 2026 it receives security patches only — all new feature work happens in Better Auth itself, which has passed 26,000 GitHub stars and 150,000 weekly npm downloads. Teams starting new Next.js, SvelteKit, or Nuxt projects should default to Better Auth; existing Auth.js integrations remain supported for security fixes but won't gain new capabilities. See the Better Auth announcement.

Also Watching

• Kubernetes — CVE-2026-35469, a memory-amplification denial-of-service in moby/spdystream's SPDY frame parsing, remains under active tracking; Kubernetes 1.34 entered maintenance mode August 27, 2026 (EOL October 27, 2026).
• Keycloak — no new release since 26.7 (July 9, 2026), which added a preview SCIM API for user provisioning and simplified multi-cluster HA without external caches.
• Node.js — no security release published yet in September; the last cycle landed July 28, 2026 across the 26.x/24.x/22.x lines.
• Apache Kafka — still on 4.3.1 (June 25, 2026); no September release identified as of publication.

What This Means For Your Stack

The highest-priority action today is patching Redis and MongoDB if you're running either as a network-reachable service — both ship multiple RCE-class fixes in this cycle. Docker and Next.js users should confirm they're on the patched builds above, and any team relying on Cloudflare D1's Free tier or Supabase's logs.all endpoint has a hard deadline this month to adjust. Everything else here is lower urgency but worth queuing into your next sprint.