Keycloak 26.8.1 Security Fixes, Next.js 16.4.3, BullMQ

Executive Summary

• Keycloak 26.8.1 (Oct 13) is a security release covering privilege escalation, token exchange and OIDC logout flaws. See the Keycloak releases.
• Next.js 16.4.3 (Oct 23) backports Google Fonts, proxy.ts and OpenTelemetry fixes. See v16.4.3.
• BullMQ 6.4.1 and 6.4.2 (Oct 23 and 24) ship dependency security patches, including a pinned fast-uri. See the BullMQ releases.
• Reminder: Node.js 26.12.1, 24.22.1 and 22.23.4 carry the October security releases.

Also on npm in the last few days: Motion 14.6.0, Prisma 8.0.0-rc.27, Clerk Next.js SDK 7.9.20 and Wrangler 4.152.0. Their release notes were not reviewed, so read them before upgrading.

Keycloak 26.8.1: Privilege Escalation and Token Exchange Fixes

The 26.8.1 release follows 26.8.0 (Oct 1), and the release page is truncated, so this list may not be complete. Fixes visible in the notes:

• CVE-2026-94000: a delegated admin with only manage-users can become realm admin through a group that maps an admin role. CVE-2026-94001: an admin credential DELETE bypasses a denied reset-password permission.
• CVE-2026-97846: Standard Token Exchange skips required mTLS certificate binding.
• CVE-2026-18569: OIDC broker backchannel logout accepts forged, unsigned tokens when signature validation is disabled. CVE-2026-15943: updating an OIDC identity provider reuses a masked client secret after the token URL changes.
• CVE-2026-95503: possible KDC spoofing when Kerberos password authentication is on. CVE-2026-103884: path traversal via a client-supplied X.509 CRL path.

The notes also mention a weakness (#53354) that allowed unauthenticated login as an arbitrary user through the SAML broker HTTP-Redirect binding, plus several Jackson and simple-git dependency CVEs. The previous patch release, 26.7.5 (Sep 30), fixed CIBA and Device Authorization brute-force lockout bypasses and a client secret exposure to the view-clients role. If you run 26.7.x or older, plan the jump:

# container deployments
docker pull quay.io/keycloak/keycloak:26.8.1

# afterwards, review delegated-admin roles and group role mappings
# (CVE-2026-94000) and any client using token exchange with mTLS

Next.js 16.4.3: Backported Fixes

v16.4.3 is marked Latest and does not include all canary changes. It fixes extensionless Google font URLs in both bundlers (#100277), stops loading the app-page runtime in proxy.ts (#100423), reverts a Turbopack loader invalidation update (#100438), keeps OpenTelemetry request traces together (#100542) and avoids loading standalone React in the server bootstrap (#100610). Make sure you are at least on 16.4.1 for the October 14 security fixes.

npm install [email protected]
npm ls next sharp   # sharp must resolve to 0.35.5 or later

BullMQ 6.4.1 and 6.4.2: Security Dependency Patches

6.4.1 (Oct 23) updates security patches (#4986) and 6.4.2 (Oct 24) pins fast-uri to a patched version (#5009). The release pages give no further detail, and 6.4.0 added reliable realtime messaging. Upgrade and refresh the lockfile:

npm install [email protected]
npm ls fast-uri

Prisma 8 RC Train: Scripting Breaks

npm now lists 8.0.0-rc.27, but the release page I could read stopped at rc.20, so rc.21 to rc.27 are not summarized. rc.20 (Oct 22) changed that piped ORM commands print data lines instead of JSON, so scripts that parse output need the --json flag, and contracts store a column's real type, which changes storage hashes for contracts that used type aliases.

Action Items

• Move Keycloak to 26.8.1 and review delegated-admin group mappings.
• Bump Next.js to 16.4.3 and BullMQ to 6.4.2.
• Confirm Node.js is on 22.23.4, 24.22.1 or 26.12.1.

Coverage note: versions and dates come from the npm registry and GitHub release pages. Docker, Kubernetes, Cloudflare, databases and most other tracked tools had no verified changes in this run.