Docker 29.9.1, Node 26.12 and Next.js RCE Patch Guide

Executive Summary

• Security: Docker Engine 29.9.1 (October 14) updates containerd to v2.4.2, fixing three vulnerabilities including host disk exhaustion from unbounded layer data.
• Security follow-up: the Next.js 16.4.1 / 15.5.28 update fixes two critical RCEs and one high-severity DoS. The image RCE only applies on glibc-based Linux, which covers most Debian and Ubuntu Docker images.
• Runtimes: Node.js 26.12.0 (Current) and Node.js 24.22.0 (LTS) shipped on October 14.
• Watch list: Keycloak 26.8.x and SvelteKit 3.0 are recent, and Prisma ORM 8 is still a release candidate with a stable release expected in October.

Coverage note: today's audit could verify primary sources for Docker, Node.js and Next.js. Other stack items had no confirmed releases dated October 15 or 16 at publication time.

Docker Engine 29.9.1

Per the Docker Engine release notes, 29.9.1 bundles containerd v2.4.2, which addresses a crash from a malformed digest in a child descriptor, a crash from a crafted Content-Length header with parallel layer fetching, and possible host disk exhaustion from unbounded layer data. Pulling images from untrusted registries is the exposure to care about.

• Fixes: --link-local-ip now rejects non-link-local addresses; docker ps -s no longer fails when one container's size cannot be computed; docker save no longer leaves layers behind for repeated layers.
• Networking and rootless: firewalld docker zone handling is adjusted, bridge network restoration on daemon start is fixed, and RootlessKit moves to v3.3.0.

Verify after upgrading:

docker version --format '{{.Server.Version}}'
docker info | grep -i containerd

Next.js 16.4.1 and 15.5.28: check your sharp version

The official advisory covers GHSA-673q-mjm6-r5xr (critical RCE in use cache functions returning typed arrays, App Router with Cache Components, no workaround), CVE-2026-96889 (critical RCE in the Image Optimization API with SVG on glibc Linux) and GHSA-p3m5-59mp-jv5r (high-severity Server Actions CPU exhaustion). Pages Router apps and apps without Server Actions are not affected by the DoS.

Upgrade, then confirm the resolved sharp version, since the image workaround is sharp 0.35.5 or later. Third-party coverage reports that Next.js 15.x still accepts sharp ^0.34.3, so an old lockfile entry can survive the upgrade; verify it yourself:

npm install [email protected]   # or [email protected] on the 15.x line
npm ls sharp
npm install sharp@^0.35.5

Severity scores differ between secondary sources, so rely on the official advisory. For context, an earlier sharp advisory on inherited libvips flaws is tracked as GHSA-f88m-g3jw-g9cj.

Node.js 26.12.0 and 24.22.0

Both releases appear on the Node.js release blog dated October 14, and neither is listed as a security release. Check the vulnerability category for anything pending. Pin the LTS line in production images:

FROM node:24.22.0-bookworm-slim
# glibc base: make sure sharp >= 0.35.5 if you run next/image

Elsewhere in the stack

Keycloak 26.8.0 shipped on October 1 with SCIM and Multi-Cluster v2 moving to supported, per Phase Two's write-up. Prisma's changelog shows ORM 8 still at release candidate. No new releases dated October 15 or 16 were confirmed for Django, Laravel, Astro or PostgreSQL.

Action checklist

1. Upgrade Next.js to 16.4.1 or 15.5.28 and confirm sharp resolves to 0.35.5 or later.
2. Upgrade Docker Engine to 29.9.1 on hosts that pull third-party images.
3. Move Node.js images to 24.22.0 (LTS) or 26.12.0 and rebuild.