Daily Dev Stack Release Audit — July 28, 2026: Redis, MongoDB, and Nuxt Rush Out Critical Security Patches

Security teams had a genuinely busy week. Between July 22 and July 27, 2026, Redis shipped an emergency out-of-band release across seven supported branches to close an RCE chain, MongoDB disclosed 18 new CVEs including one scoring 9.2 on CVSS, Nuxt patched eight security advisories headlined by an unauthenticated DevTools RCE, and both Next.js and Node.js shipped their own coordinated security releases. Below is the full audit across containers, identity, meta-frameworks, backend runtimes, UI systems, databases, ORMs, and messaging.

Executive Summary

• Redis — emergency release (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1) closes a Streams double-free bug described as an incomplete fix of CVE-2026-25243, plus a RedisBloom/TDigest out-of-bounds write; both were chained into a working RCE proof-of-concept.
• MongoDB — 18 new CVEs disclosed, led by CVE-2026-13072 (CVSS 9.2, memory corruption via BSON aggregation with Compute Mode enabled). Fixed in Server 7.0.39, 8.0.28, 8.2.12, 8.3.7.
• Nuxt — v4.5.1 / v3.21.10 fix 8 GitHub Security Advisories, including an unauthenticated DevTools RPC RCE and a server-side template-injection RCE via server island props.
• Next.js — July 2026 security release (v16.2.11, v15.5.21) fixes 9 CVEs across Server Actions, Turbopack middleware, and the Image Optimization API.
• Node.js — coordinated HIGH-severity security release across the 22.x, 24.x, and 26.x lines shipped July 27; exact CVE IDs remain embargoed as of publication.
• RabbitMQ — CVE-2026-57219 (CVSS 8.7) let unauthenticated attackers pull a broker's OAuth client secret from a legacy management endpoint; patched in 4.3.0, 4.2.6, 4.1.11, 4.0.20, 3.13.15.
• Docker Desktop 4.84.0 fixes a config-parsing hang and a credential-storage bug that could silently erase Hub OAuth tokens.
• Vercel added regional inference pinning and WebSocket support to AI Gateway, plus a beta WAF for Blob storage.
• Better Auth 1.7.0-rc.2 restructures account/identity scoping — a breaking change worth testing in staging before upgrading.

Databases, Caching & Vector Search

Redis — Emergency Multi-Branch Security Release

On July 23, 2026, the Redis team pushed simultaneous patch releases across every supported branch: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, and 8.8.1. The release closes two memory-corruption issues: a Streams shared-NACK double-free — triggered when two consumers reference the same pending-entry record and both are removed via XGROUP DELCONSUMER — and a RedisBloom/TDigest RESTORE handler that trusts an attacker-controlled capacity field, causing an out-of-bounds write. The Streams bug is described as an incomplete fix of the earlier CVE-2026-25243. According to The Hacker News, the chain was originally surfaced by autonomous AI agents that built a working RCE proof-of-concept before the vendor patch shipped.

# Check your running version and upgrade
redis-cli INFO server | grep redis_version

# Debian/Ubuntu (redis-server package)
sudo apt update && sudo apt install --only-upgrade redis-server

# Docker
docker pull redis:8.8.1
docker compose up -d redis

Source: redis/redis releases on GitHub

MongoDB — 18 New CVEs, Led by a 9.2-Severity Bug

MongoDB disclosed 18 new CVEs on July 22–24, 2026. The most severe, CVE-2026-13072 (CVSS 9.2), is a memory-corruption bug from improper validation of externally-sourced BSON during aggregation pipeline processing when "Compute Mode" is enabled on a standalone mongod. It affects Server 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2 before 8.2.12, and 8.3 before 8.3.7. A second flaw, CVE-2026-13059 (CVSS 8.6), allows RBAC bypass via improperly validated client-supplied command parameters. MongoDB Compass users should also update to 1.49.7 for CVE-2026-14881, an OIDC connection-import flaw. Patch to Server 7.0.39, 8.0.28, 8.2.12, or 8.3.7 as soon as your maintenance window allows.

Source: Canadian Centre for Cyber Security advisory AV26-744

ClickHouse & DuckDB — Analytics Engines Keep Shipping

ClickHouse 26.7 (July 22) adds EXPLAIN ANALYZE, lets projections carry their own WHERE clauses, and introduces Remote/RemoteSecure table engines — but ships breaking changes too: S3 access from SQL no longer auto-uses server credentials, and AggregatingMergeTree now rejects non-aggregate columns outside the sorting key. DuckDB 1.5.5 (also July 22) is a bugfix-and-security patch release for the 1.5 "Variegata" line — no CVE numbers were published alongside it.

Sources: ClickHouse changelog · DuckDB 1.5.5 announcement

No changes landed this window for PostgreSQL (latest minor was May 14; PostgreSQL 19 Beta 2 shipped July 16) or pgvector (0.8.5 remains current).

Meta-Frameworks & Core Web Standards

Nuxt — Critical RCE Fixes in v4.5.1 / v3.21.10

Nuxt shipped v4.5.1 and v3.21.10 on July 27, 2026, closing eight GitHub Security Advisories. The two most severe: GHSA-279x-mwfv-vcqv (Critical) — an unauthenticated Nuxt DevTools RPC endpoint allowed arbitrary command execution on the dev host, fixed via @nuxt/devtools 3.3.1 — and GHSA-9473-5f9j-94wq (High) — server-side RCE via runtime template injection in server island props. Also patched: an SSR payload cache that could leak one user's data to another, and route rules silently dropped for mixed-case paths, which could bypass auth middleware. If you use cache/swr/isr route rules, purge your CDN cache after upgrading. Note that Nuxt 3.x reaches end-of-life on July 31, 2026, so 3.21.10 is effectively the last 3.x security release.

npm install nuxt@^4.5.1
# or, on the 3.x line (EOL July 31, 2026):
npm install nuxt@^3.21.10

Source: nuxt/nuxt v4.5.1 release notes

Next.js — July 2026 Security Release

Next.js published a coordinated security release on July 20–21, 2026 (v16.2.11 Active LTS, v15.5.21 Maintenance LTS) fixing 4 High- and 5 Medium-severity CVEs: a Server Actions denial-of-service via CPU exhaustion in the App Router, a Turbopack middleware/proxy bypass affecting single-locale App Router apps, an SSRF via rewrites with an attacker-controlled destination hostname, an SSRF via Server Actions on custom servers, an Image Optimization API DoS via crafted SVGs, and a cache-confusion bug that could return the wrong cached response body for fetch requests with bodies.

Source: Next.js July 2026 security release

Node.js — Coordinated Security Release (Details Embargoed)

Node.js shipped coordinated security releases across the 22.x, 24.x, and 26.x lines on or shortly after July 27, 2026. The project's own pre-release alert confirms the highest severity in this batch is HIGH across all three lines, but as of publication Node.js has not yet published the specific CVE IDs, affected components, or exact patched version numbers — standard practice for coordinated disclosure. Treat this as an active-watch item: check the official advisory before assuming which version fixes what.

Source: Node.js July 2026 security releases

SvelteKit, Svelte, Vue, React & Astro — Routine Cycle

Everything else in this category shipped routine, non-security work this week: React 19.2.8 / 19.1.9 / 19.0.8 (July 21) improve React Server Components decoding performance. Vue.js 3.6.0-rc.2 (July 22) is the second release candidate stabilizing Vapor Mode and the new alien-signals reactivity core. SvelteKit @sveltejs/[email protected] (July 24) is a breaking-change prerelease that renames the Pathname type to Path and Asset to AssetPath, and adds a new $app/manifest module. Svelte 5.56.8 (July 24) is a patch release. Astro 7.1.4 (July 27) fixes duplicate CSS emission, a missing background prop on <Image>/<Picture>, and a silent session-runtime error swallow.

Backend Frameworks & Runtimes

Beyond the Node.js security release above, the backend runtime layer had a quiet week. Hono v4.12.32 (July 24) hardens query/header/param parsing by using Object.create(null) internally. FastAPI v0.140.2 (July 27) continues a memory-optimization series by no longer retaining flat dependency trees internally. Laravel shipped two feature releases — v13.22.0 (July 24) adds stream-body support for HTTP fake responses and a new #[BindWhen()] container-binding attribute; v13.23.0 (July 27) adds a monthly log driver and switches the maintenance-mode bypass secret comparison to timing-safe. NestJS, Fastify, Express, Django, and ElysiaJS had no releases in this window; their most recent versions remain unchanged from earlier in July.

Containers, Edge & Infrastructure

Docker Desktop 4.84.0

Released July 27, 2026, this patch fixes a hang/high-CPU bug triggered by an invalid ~/.docker/config.json, and a credential-storage bug that could erase Docker Hub OAuth tokens when an unrelated ID was deleted. It follows 4.82.0's fix for CVE-2026-8936, a VM panic via unbounded recursion in the grpcfuse kernel module.

Source: Docker Desktop release notes

Vercel, AWS & Cloudflare

Vercel shipped regional inference pinning (US/EU) and WebSocket support for the OpenAI Responses API on AI Gateway (July 27), plus a beta WAF for Blob storage and extended Workflow step durations (July 24). AWS's July 27 weekly roundup includes a new EMEA Local Zone in Athens and Claude Opus 5 landing on Amazon Bedrock with zero data retention by default. Cloudflare continued rolling out Agents SDK / Code Mode updates for its MCP tooling, though the exact date of the latest schema update wasn't independently confirmed at publication time.

Sources: Vercel changelog · AWS Weekly Roundup, July 27, 2026

Kubernetes & Podman — Recent Context

Just outside this week's window but still fresh: Kubernetes v1.34 ("Of Wind & Will") went GA July 21 with Dynamic Resource Allocation and VolumeAttributesClass both graduating to GA. Podman 6.0.2 (July 22) is the latest patch on the 6.0 major line, which removed cgroups v1, iptables, CNI, slirp4netns, and BoltDB support in favor of nftables and Netavark/Pasta.

No release in this window was found for Railway or Render beyond routine CLI patches.

Identity & Authentication (IAM)

Better Auth — Breaking Changes Incoming in 1.7

Better Auth's 1.6.x line kept shipping fixes through the window — 1.6.24 (July 22) added request context to verifyIdToken and a beforeStoreCookie GDPR hook; 1.6.25 (July 23) fixed Apple OAuth PKCE issues and a Google One Tap bug that could create duplicate users. More significant is v1.7.0-rc.2 (July 22), a breaking-change release that restructures account/identity scoping and moves database-join configuration under advanced.database.joins.

// Better Auth 1.7.0-rc.2 — database join config moved:
export const auth = betterAuth({
  // before (1.6.x):
  // databaseHooks: { joins: { ... } },

  // after (1.7.0-rc.2+):
  advanced: {
    database: {
      joins: {
        // your join config here
      },
    },
  },
});

Source: better-auth/better-auth releases

Clerk, Authentik & Keycloak

Clerk published composable UserProfile/OrganizationProfile components on July 27 via a new @clerk/ui experimental API, letting teams assemble profile pages from individual panels instead of the monolithic prebuilt widgets. Authentik 2026.5.6 (July 22) fixed app-view permission bugs, per-IP rate throttling, and flow-locale handling. Keycloak's most recent release remains 26.7.0 from July 9, which added a preview SCIM API and simplified multi-cluster HA — no new Keycloak release landed in this window. Auth0 and Auth.js/NextAuth had no notable releases this week.

Sources: Clerk changelog · authentik releases

UI Systems, Styling & Motion

shadcn/ui made Base UI (v1.6.0+) the default base for new shadcn init projects this month, with Radix still available via the -b radix flag; it also shipped a new Base UI-powered Toast component and added React Aria Components as a selectable base. Radix UI published 1.6.7 on July 24, with 1.7.0 release candidates cut on the 21st, 24th, 25th, and 27th — official changelog detail for those specific patch versions hadn't been published as of this writing. Motion (formerly Framer Motion) didn't ship a core library release this window, but launched Motion UI, a paid pre-built animated component library, on July 23. Tailwind CSS and Material UI had no releases in this window; their latest versions remain 4.3.3 and 9.2.0 respectively.

Database Tools, ORMs & BaaS

Prisma shipped Object Store buckets on July 24 — S3-compatible file storage that lives alongside Prisma Postgres databases, managed through Console, the Management API, or MCP tools. Supabase moved Pipelines (managed Postgres-to-BigQuery CDC) into Public Alpha on July 21, and flagged a breaking change for self-hosted deployments: the default API gateway switches from Kong to Envoy the week of August 9, and self-hosted API_EXTERNAL_URL now includes /auth/v1 — SAML SSO users will need to repoint their IdP to the new /auth/v1/sso/saml/* endpoints. Firebase's JS SDK sits at v12.16.0 (July 9), with no newer release found this window. Drizzle ORM — we could not confirm a genuine, dated release for this window from official sources; version claims found in search results were inconsistent, so we're deliberately not reporting a specific version here. Check Drizzle's GitHub releases directly if you need the current version.

Sources: Prisma changelog · Supabase changelog

Background Jobs, Messaging & Task Queues

The standout item here is RabbitMQ CVE-2026-57219 (CVSS 8.7): the legacy GET /api/auth management HTTP endpoint leaked a broker's OAuth client secret to an unauthenticated caller in a single request when OAuth2 was configured — described as "a direct path to full broker takeover." A companion issue, CVE-2026-57221 (CVSS 5.3), let any authenticated user enumerate queue and exchange names regardless of permissions. Both are fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 — if you're running an older branch with OAuth2 enabled, prioritize this patch. BullMQ shipped routine patches (v5.80.7 through v5.80.10, July 17–21) with a flow-producer performance fix and a worker bug fix for manually-fetched stalled jobs. Apache Kafka and Temporal had no releases or advisories in this window.

# Check RabbitMQ version and upgrade if OAuth2 is enabled
rabbitmqctl status | grep 'RabbitMQ version'

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade rabbitmq-server

Source: The Hacker News — RabbitMQ OAuth secret leak

What to Patch Today

• Redis → 8.8.1 / 8.6.5 / 8.4.5 / 8.2.8 / 7.4.10 / 7.2.15 / 6.2.23 (RCE chain) — highest urgency.
• MongoDB Server → 8.3.7 / 8.2.12 / 8.0.28 / 7.0.39 (CVSS 9.2 memory corruption).
• Nuxt → 4.5.1 or 3.21.10 (unauthenticated RCE via DevTools).
• RabbitMQ → 4.3.0+ if OAuth2 is enabled (OAuth secret leak).
• Next.js → 16.2.11 / 15.5.21 (9 CVEs, SSRF and DoS).
• Node.js → check the official advisory now that 22.x/24.x/26.x security releases have shipped.
• Docker Desktop → 4.84.0 (credential-storage and hang fixes).

This audit reflects publicly available release notes, vendor changelogs, and security advisories as of July 28, 2026. Where an exact patch date or CVE mapping could not be independently confirmed from a primary source, it's been noted in the text above — always verify against the vendor's official advisory before rolling out a security patch to production.