Nuxt 4.6.4 Patches 8 Advisories, Fastify 5.12.8 Fix

Executive Summary

• Nuxt 4.6.4 (Nov 2) is a security release: eight Nuxt advisories plus three Nitro advisories via nitropack 2.13.6. See the release notes.
• Fastify 5.12.8 (Nov 2) includes a fix for GHSA-3qgw-9275-xf8w and hardens error status codes and custom content type parsers. Release notes.
• BullMQ 6.5.4 (Nov 2) bumps msgpackr to 2.1.3, tagged as a security fix. Release notes.
• Next.js shipped 16.4.4 on Nov 2 and has a scheduled security release today (Nov 3) covering seven medium-severity issues. Full advisories were not yet visible when this audit ran; see the 16.4.4 notes.
• Also shipped: Tailwind CSS 4.3.4 (new Turbopack loader), Astro 7.4.5 and adapter patches, and Wrangler 4.156.2.

Nuxt 4.6.4 and Nitro

The 4.6.4 release is mostly hardening. The changes most likely to affect your app:

• Error pages: production error pages and payloads include only the message and data of errors created with createError.
• Caching: cached routes (cache, swr, isr) only cache GET and HEAD, and skip responses that set cookies or use private or no-store headers.
• Route rules: encoded slashes now match, so /api%2Fadmin is covered by an /api/** rule. Wildcard proxy and redirect rules reject targets outside the rule's scope.
• Proxy headers and dev servers: x-forwarded-proto is trusted only when explicitly enabled, and webpack and rspack dev servers reject unexpected Host headers. A new devServer.allowedHosts option controls this.

If your dev setup uses a custom hostname, allow it explicitly:

export default defineNuxtConfig({ devServer: { allowedHosts: ['my-dev.example.com'] } })

npm install [email protected]

Fastify 5.12.8

The release notes reference a fix for GHSA-3qgw-9275-xf8w without describing it, so read the advisory before assessing exposure. Related hardening in the same release: error statusCode values are clamped to 400-599 (falling back to 500), and synchronous throws from custom content type parsers are contained. It also adds routerOptions.compile for find-my-way compiler mode and disposable support in onClose hooks.

npm install [email protected]

BullMQ 6.5.4

A one-line patch: the release updates msgpackr to 2.1.3 and labels it a security fix. The notes give no CVE or details, so treat it as a routine dependency upgrade for queue workers.

npm install [email protected]

Next.js 16.4.4 and Today's Security Release

Version 16.4.4 is a stable backport: Turbopack now reloads the page when it misses CSS updates at startup, PPR resume emits the Turbopack shared-runtime bootstrap so it receives the CSP nonce, and jsonwebtoken was replaced with fast-jwt. Separately, the team's advance notice says seven medium-severity vulnerabilities are fixed in today's release, with advisories published alongside. Check the Next.js releases page and your lockfile today, and upgrade as soon as the patched versions are listed.

npm install next@latest

Tailwind CSS 4.3.4, Astro 7.4.5, Wrangler 4.156.2

• Tailwind CSS 4.3.4 adds @tailwindcss/turbopack, a Turbopack loader for Next.js, and fixes about 40 bugs across watch mode, @scope handling, class detection and CSS parsing.
• Astro 7.4.5 returns 400 for invalid percent-encoded URLs, stops corrupting import.meta.env values containing $ sequences at build time, and throws on invalid dynamic tag names. The Vercel and Netlify adapters fix NFT tracing that pulled unrelated workspace files into function bundles.
• Wrangler 4.156.2 is a patch: default compatibility date moves to 2026-11-02, workerd and workers-types are bumped, and route permission checks fetch only the relevant categories so Worker-scoped Editor tokens can upload Workers without routes.

Coverage Note

This audit covered npm registry activity for the JavaScript stack and official release pages. Docker, Kubernetes, PostgreSQL, Redis, Keycloak and other non-npm projects were not verified against their own feeds today, so no claims are made about them. Hono 4.13.16 and Prisma 8 RC (covered yesterday) are unchanged.