Dev Stack Release Audit, Nov 4 2026: Security Patches for Next.js, Hono, Fastify and Better Auth

Executive Summary

• Next.js 15.5.29 fixes three moderate advisories: cross-client response injection in self-hosted apps, an SVG bypass in image optimization, and HttpOnly cookie exposure on Edge routes (release).
• Hono 4.13.16 is a security release with five advisories covering mount(), RegExpRouter, validator('form'), the css helper and csrf() (releases).
• Fastify 5.12.8 fixes GHSA-3qgw-9275-xf8w and tightens reply and error handling (release).
• Better Auth 1.7.16 is a large security-hardening release: session revocation, phone verification, OAuth email_verified handling, passkeys and more (release).
• Tailwind CSS 4.3.4 adds @tailwindcss/turbopack (release). Astro 7.4.5, Wrangler 4.157.0 and BullMQ 6.6.0 are smaller updates.

Note: GitHub was not directly reachable from my audit environment for every project, so version and timing data comes from the npm registry, with release notes read from GitHub release pages where available. Projects not listed below showed no stable release in the window I could verify.

Security Patches

Next.js 15.5.29

Released November 3. All three fixes are rated Moderate, and the release page lists GHSA IDs rather than CVEs:

• GHSA-pc58-hwjq-p385: cross-client response injection and disclosure in self-hosted apps that forward fetched responses.
• GHSA-7qx7-33qx-rqx2: SVG rejection bypass in image optimization.
• GHSA-f3mh-rxg3-f5g2: HttpOnly cookie exposure through an internal response header on Edge runtime routes.

If you self-host or use the Edge runtime, upgrade now. On the 16.x line, 16.5.0-canary.39 and .40 shipped on November 3 (npm); check the advisories for the fixed 16.x version before assuming you are covered.

npm install [email protected]

Hono 4.13.16

Released November 1, following 4.13.15 an hour earlier. The five advisories:

• GHSA-4m76-xfj5-7975: a crafted request could skip middleware scoped inside a mount() prefix.
• GHSA-h7mg-cq63-vhpq: RegExpRouter (including the default SmartRouter) could skip wildcard middleware. Custom patterns that can match an empty string now throw UnsupportedPathError.
• GHSA-4h7h-rv7c-7m2v: validator('form') was bypassed by multipart/form-data requests with extra parameters such as charset.
• GHSA-3gg2-335m-rxc6: the css helper did not escape an assembled </style>, allowing HTML injection.
• GHSA-46wx-v44x-9hh2: csrf() did not check Origin and Sec-Fetch-Site on text/ping requests.

The release also rejects JWT signatures outside the base64url alphabet and headers containing crit. If you use PreparedRegExpRouter, regenerate its data after upgrading. Test your route patterns, since routes like /assets* and duplicate parameter names now throw.

npm install [email protected]

Fastify 5.12.8

Released November 2 (npm). It fixes GHSA-3qgw-9275-xf8w; the release page does not describe the issue, so read the advisory for severity and affected versions. Other changes:

• Error status codes are clamped to 400 to 599, with 500 as the fallback.
• Reply streams send trailers only after the stream finishes.
• Synchronous throws from custom content type parsers are contained.
• New routerOptions.compile enables find-my-way's compiler mode, and onClose hooks accept disposables.

A 6.0.0-alpha.6 also appeared the same day, so keep production on the 5.x line.

Better Auth 1.7.16

Released November 3, with a 1.8.0-beta.5 following the same evening. This is the most security-dense release of the day. Highlights from the notes:

• Revoked sessions could stay usable with secondary storage or cookie cache; bulk revocation is fixed.
• Phone numbers were stored before verification; sign-up and sign-in now reject a client-supplied phoneNumber.
• /admin/update-user now requires a new user:set-phone permission to change phone numbers.
• Email OTP concurrency could exceed allowedAttempts; email verification and change links could work for the wrong account.
• OAuth providers sending email_verified as the string "false" were treated as verified, including Cognito and Microsoft Entra ID.
• Passkeys now take the WebAuthn origin from server config and enforce userVerification: "required".
• Trusted-origin wildcards no longer match outside the intended scheme, host or path.

Two upgrade actions: add the new set-phone statement to your custom access control if you use one, and write stripeCustomerId through the database adapter rather than auth.api.updateUser.

npm install [email protected]

Framework and Tooling Updates

Tailwind CSS 4.3.4

Released November 2. The one feature is @tailwindcss/turbopack, a Turbopack loader for Next.js. The rest are fixes: Vite plugin stability under bundledDev, @scope handling, canonicalization, and a WASM fallback for @tailwindcss/oxide when native bindings are missing. See the release notes.

Astro 7.4.5

Released November 2 (release). Request paths with invalid percent-encoding such as /%C0%AF now return a 400. import.meta.env values containing $$ or $& are no longer corrupted during builds, and string tag names are rendered strictly.

Cloudflare Wrangler 4.157.0

Released November 3 (release). Notable items:

• wrangler delete now offers to delete Container applications created by wrangler deploy, which previously kept running and billing.
• Opt-in zstd compression for container image layers.
• Default compatibility date moves to 2026-11-03.

WRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd npx wrangler deploy

BullMQ 6.6.0

Released November 4. It adds a schedule option to deduplication across the Python, Elixir, PHP, Rust and .NET clients (release).

Other Movement Worth Tracking

These are version-level observations from the npm registry, not full release-note reviews:

• Nuxt 4.6.4 shipped November 2 (npm).
• Prisma 8.0.0-rc.30 shipped November 3 (npm).
• Firebase JS SDK 13.2.0 shipped November 2 (npm).
• Vue 3.6.0-rc.14 shipped October 30 (npm).
• Elysia 2.0.0-rc.1 shipped October 28 (npm).

What I Would Do Today

1. Bump Next.js, Hono and Fastify in any service exposed to the internet, then run your route and middleware tests.
2. Upgrade Better Auth and review custom access control and Stripe wiring.
3. Treat the pre-release lines (Fastify 6 alpha, Better Auth 1.8 beta, Prisma 8 RC) as staging-only.

Sources

• Next.js v15.5.29
• Hono releases
• Fastify v5.12.8
• Better Auth v1.7.16
• Tailwind CSS v4.3.4
• Astro 7.4.5
• Cloudflare workers-sdk releases
• BullMQ v6.6.0
• npm registry