Dev Stack Release Audit — September 10, 2026: Keycloak Patches Critical Account-Takeover Flaw as PostgreSQL Fixes a 12-Year RCE Bug

Executive Summary

• Keycloak patched CVE-2026-18963, a critical (CVSS 9.1) unauthenticated account-takeover flaw in the reset-credentials flow — upgrade to 26.7.2 immediately.
• PostgreSQL fixed CVE-2026-6471 ("PostGREShell"), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code — patched in 18.6, 17.11, 16.15, 15.19, and 14.24.
• Docker Desktop shipped a fix for CVE-2026-17106, a destination-escape flaw in docker container cp, plus a Kind image bump covering two more CVEs — see the release notes.
• Kubernetes patch releases addressed CVE-2026-33814 (HTTP/2 infinite loop) and CVE-2026-35469 (SPDY memory amplification DoS); 1.34 entered maintenance mode on August 27 with EOL set for October 27, 2026.
• Cloudflare Workers now allows 64 MiB uncompressed bundles on every plan and defaults Python Workers to Python 3.14.
• Vercel's September 9 platform update adds free Vercel Authentication gating for production domains and per-project Password Protection on Pro.
• Prisma's prisma@latest tag on npm now resolves to the unstable 8.x line — pin production installs to 7.10.0 explicitly.
• Better Auth 1.7.3 landed with session-cleanup, OTP, JWT, and Redis performance fixes, while shadcn/ui consolidated its cn helper into a standalone package.

Identity & Auth: Keycloak Patches a Critical Account-Takeover Flaw

Red Hat and the Keycloak project disclosed CVE-2026-18963, rated 9.1 on the CVSS scale, in the reset-credentials authentication flow. Improper state validation let an unauthenticated remote attacker force a password reset and take over any account. Upstream Keycloak is fixed in 26.7.2 (released August 19, 2026); Red Hat build of Keycloak (RHBK) users should apply the updates shipped for 26.4.15 and 26.6.6. If you cannot patch immediately, disable self-service password reset and audit recent reset-credentials events for anomalies.

# Upstream Keycloak — check your running version, then upgrade
bin/kc.sh --version

# Docker deployments
docker pull quay.io/keycloak/keycloak:26.7.2
docker run -d --name keycloak -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=change-me \
  quay.io/keycloak/keycloak:26.7.2 start-dev

Databases: PostgreSQL Closes a 12-Year-Old Replication RCE

Dubbed "PostGREShell" by researchers, CVE-2026-6471 (CVSS 7.2) has existed since logical decoding shipped in PostgreSQL 9.4 back in 2014. Any role with the REPLICATION attribute on a server running wal_level = logical — a category that covers most CDC pipelines, standbys, and backup tools — could load an arbitrary output plugin and execute code. The fix, shipped August 13 in 18.6, 17.11, 16.15, 15.19, and 14.24, adds a new output_plugin_libraries allowlist parameter. Debian's advisory notes that CDC tooling such as wal2json and decoderbufs needs an explicit config update or logical replication will break after patching.

# postgresql.conf — after upgrading to 18.6 / 17.11 / 16.15 / 15.19 / 14.24
# Explicitly allowlist any output plugins your CDC/replication tooling uses
output_plugin_libraries = 'pgoutput, test_decoding, wal2json'

Containers & Infra: Docker Fixes a Container-Escape Bug, Kubernetes Patches Two DoS CVEs

The latest Docker Desktop release closes CVE-2026-17106, a destination-escape flaw in docker container cp, and bumps the bundled Kind cloud-provider image to v0.7.0 to cover CVE-2026-46595 and CVE-2026-39834. It also fixes Linux arm64 startup failures caused by incorrect QEMU binary-path resolution and tightens Gordon AI's error handling. Separately, Docker Engine 29 remains the current stable line for server deployments.

On the orchestration side, recent Kubernetes patch releases addressed CVE-2026-33814, an infinite-loop denial-of-service in the HTTP/2 transport, and CVE-2026-35469, a memory-amplification issue in SPDY frame parsing — both remotely triggerable against the API server. Kubernetes 1.34 entered maintenance mode on August 27, 2026, with end-of-life set for October 27, 2026, so clusters still on 1.34 should schedule an upgrade window now.

Edge & Hosting: Cloudflare Raises Worker Size Limits, Vercel Adds Free Auth Gating

Cloudflare removed the compressed-size check on Workers on September 4 — deploys are now measured only against a 64 MiB uncompressed limit, up from the old 3 MB (Free) / 10 MB (Paid) compressed ceiling, which should unblock teams shipping larger framework bundles to Workers. On September 8, Cloudflare also moved Python Workers to Python 3.14 by default for any Worker using compatibility date 2026-09-08 or later, and D1 began hard-enforcing daily row read/write limits on the Free plan as of September 1.

# wrangler.toml — pin the compatibility date to opt into Python 3.14
name = "my-python-worker"
main = "src/entry.py"
compatibility_date = "2026-09-08"
compatibility_flags = ["python_workers"]

Vercel's September 9 changelog adds Vercel Authentication for production domains at no extra cost — visitors must sign in and hold project access — alongside a new $20/month per-project Password Protection tier on Pro. The update also brings changelog search to the CLI and persistent memory scopes for eve agents.

Backend & ORMs: Watch Your Prisma Lockfile, NestJS Goes ESM-First

Prisma tagged its first 8.x development build on September 1, and prisma@latest on npm now resolves to that unstable 8.x line instead of the 7.x stable series. Production installs that rely on @latest without pinning can silently pull in breaking changes. The current stable release is 7.10.0, which also ships a compatibility package for running Prisma 7 config alongside a Prisma 8 install.

{
  "dependencies": {
    "prisma": "7.10.0",
    "@prisma/client": "7.10.0"
  }
}

On the framework side, NestJS 12 continues its rollout with ESM-ready packages, first-class Standard Schema validation in route decorators, and a rebuilt CLI that swaps Jest for Vitest, ESLint for oxlint, and Webpack for Rspack. The current release, @nestjs/core 12.0.1, also adds bun as a supported package manager alongside npm, yarn, and pnpm.

UI & Auth Libraries: shadcn/ui Simplifies cn, Better Auth Ships Redis Fixes

shadcn/ui's September changelog moves generated components to import cn from a standalone package instead of a locally duplicated utility — one dependency instead of a hand-maintained helper in every project. It follows July's move to Base UI as the default primitive layer for new installs.

Better Auth 1.7.3 (tagged September 6) improves session cleanup, OTP flows, JWT handling, and Redis-backed session performance, plus adds a utility for stable placeholder emails. Auth.js/NextAuth, now maintained by the Better Auth team, remains on security-fix-only status while new features land in Better Auth first.

Quick Hits

• MongoDB shipped 7.0.40 and 8.0.30, each bundling a double-digit batch of CVE fixes — check the release notes for the full advisory list before your next maintenance window.
• SvelteKit's sv CLI added an ai-tools add-on replacing the old mcp add-on, and sv@next now ships a task-based migration path toward SvelteKit 3.
• Laravel 13.26.1 is the current stable release (per the project's release history), continuing the framework's 18-month bug-fix / 24-month security-fix support window.
• Redis client libraries keep pace with server 8.10 — go-redis 9.22.0 adds experimental RESP3 client-side caching and automatic pipelining, with three breaking changes around default timeouts and retry backoff, so review the migration notes before upgrading.

What to Patch Today

If you only action three things from this audit: upgrade Keycloak to 26.7.2 (or the equivalent RHBK build) to close the account-takeover flaw, patch PostgreSQL to the latest 14.x–18.x point release and re-allowlist your logical-decoding plugins, and pin Prisma to 7.10.0 explicitly so a stray @latest install doesn't pull in the 8.x development line. Everything else on this list is worth scheduling, but those three carry the most immediate risk.