Dev Stack Release Audit — September 9, 2026: Fastify Patches 4 CVEs, Docker/Podman Fix Shared RCE

The security story of the day belongs to Fastify, which shipped four High-severity fixes in a single release, and to the shared Docker/Podman container-tooling advisory patched across both projects this week. Around them, edge platforms raised limits, identity providers pushed patch releases, and analytics databases kept shipping fast. Here is what actually changed across the stack on September 9, 2026, with links back to the primary sources.

Executive Summary

• Patch now: Fastify v5.12.2 fixes four High-severity advisories (header validation bypass, request validation bypass, auth bypass via malformed URLs, request body replacement).
• Patch now: Docker and Podman both shipped fixes for CVE-2026-17106, a High-severity path-traversal bug in the shared go-archive tar-extraction code that allows container-to-host arbitrary file writes.
• Worth reviewing: MongoDB published a batch of driver and tooling advisories (CVE-2026-84962 through -84971, up to CVSS 8.2) spanning the PHP, C, and C++ drivers, libmongocrypt, and the VS Code extension.
• New capability: Cloudflare Workers raised the bundle size limit to 64 MiB (uncompressed) on all plans and dropped the compressed-size cap.
• Identity patches: Keycloak 26.7.3, Authentik 2026.8.1, and Better Auth 1.7.3 all landed as maintenance releases; Auth0's auth0-js line moved to v10.0.0, dropping HS256 token validation.
• Release-day watch: Apache Kafka 4.4.0 is targeted for today per the published release plan, though no tag was live at the time of writing.

Containers, Edge & Infrastructure

Docker & Podman: shared CVE-2026-17106 in go-archive

Both Docker and Podman consume the same moby/go-archive library for tar extraction, and both shipped fixes this week for CVE-2026-17106, a High-severity path-traversal flaw that let a malicious image or container layer write files outside the intended extraction root — a container-to-host escape vector during build or `docker cp`-style extraction. If you build images from untrusted sources or run a shared build farm, update Docker Engine/Desktop and Podman now.

Docker Compose v5.5.1

Compose v5.5.1 (Sept 3) captures lifecycle hook output directly in the CLI log stream and fixes `watch` sync, IPAM allocation, and a Windows build regression.

Cloudflare: bigger Workers, enforced D1 limits

• Workers bundle size is now capped at 64 MiB uncompressed on every plan, and the separate compressed-size limit was removed — see the Sept 4 changelog entry.
• Python Workers default to Python 3.14 for any compatibility date of 2026-09-08 or later, per the Workers changelog.
• D1 free tier daily row read/write limits are now hard-enforced — queries return errors once the quota is hit instead of degrading silently (D1 changelog, effective Sept 1).

Vercel, Render, Railway

• Vercel made Flat Rate CDN generally available for Pro teams and added GPT-6 "Astra" plus user-scoped budgets to AI Gateway (changelog, Sept 3–8).
• Render shipped redesigned Deploys/Builds/Runs dashboard pages and enabled telemetry by default in CLI 2.26.0 (changelog, Sept 1–3).
• Railway's changelog lists a Sept 4 entry; specific contents could not be independently confirmed at publish time — check the live changelog directly.

No dated September release was found for Kubernetes (v1.34 entered maintenance mode Aug 27; EOL Oct 27) or for AWS service-level changes in this window.

Identity & Authentication

Keycloak 26.7.3 and Authentik 2026.8.1

Keycloak 26.7.3 (Aug 31) bundles multiple CVE fixes alongside routine bug fixes. Authentik 2026.8.1 (Sept 1) is a patch release on the 2026.8 line. Both are maintenance updates — schedule them as normal patch-cycle work rather than emergency fixes.

Better Auth v1.7.3

Better Auth v1.7.3 (Sept 6) restores account-schema compatibility with 1.6 and adds Cloudflare as a built-in social provider:

import { betterAuth } from "better-auth"
import { cloudflare } from "better-auth/social-providers"

export const auth = betterAuth({
  socialProviders: {
    cloudflare: {
      clientId: process.env.CF_CLIENT_ID,
      clientSecret: process.env.CF_CLIENT_SECRET,
    },
  },
})

Auth0 and Clerk

• Auth0's auth0-js client moved to v10.0.0, resolving a browser-side token-validation issue tracked as CVE-2026-42280 by removing HS256 support from client-side validation paths — see the changelog. Exact publish date is unconfirmed; verify against your installed version before treating this as urgent.
• Clerk pushed several point releases (6.15.1, 4.6.5, 1.32.2) on Sept 3 fixing a sign-in flow bug, bumping the Android SDK, and correcting TOTP UX — see the Clerk changelog.

No new release was found for Auth.js/NextAuth in this window: next-auth v4 remains at 4.24.15 stable, and Auth.js v5 is still in beta at 5.0.0-beta.32.

Meta-Frameworks & Core Web Standards

Nuxt shipped patch releases for @nuxt/test-utils (4.3.1/4.3.2) and @nuxt/ui (4.11.1) on Sept 7 — see the Nuxt releases page. Svelte 5.57 landed with new SvelteMap methods, detailed in the September Svelte roundup. No dated release in this window was confirmed for Next.js (latest stable 16.3.4), React (19.2.8), Vue.js (3.5.40), or Astro (7.2.1) — all remain on their last known stable versions.

Backend Frameworks & Runtimes

Fastify v5.12.2: four High-severity fixes

Fastify's Sept 4 security advisories cover four separate High-severity issues in v5.12.2: a header-validation bypass, a request-validation bypass, an authentication bypass reachable via malformed URLs, and a request-body replacement bug. Any of these can undermine route-level auth or validation hooks, so this is a same-week upgrade for production Fastify services:

npm install [email protected]

Laravel and Hono

• Laravel added new DevCommands helpers (Sept 4) and a WorkerStopping event plus Eloquent insertOrIgnoreReturning (Sept 2) — details in Laravel News.
• Hono published v4.13.7 around Sept 6 on npm; specific changelog contents were not independently confirmed at publish time.

No release in this window was confirmed for NestJS (latest 12.0.1), Node.js (last security release July 28–29), Express (5.2.1), ElysiaJS (1.4.29), FastAPI (0.124.4), or Django (last security release Aug 4).

UI Systems, Styling & Motion

shadcn/ui consolidated its class-name helper, switching generated components to import cn from the new standalone cn package instead of duplicating the utility per-project — see the shadcn changelog. No confirmed September release was found for Radix UI, Tailwind CSS (npm changelog check was blocked by a 403, so treat this as unverified rather than confirmed-quiet), Material UI, or Motion.

Databases, Caching & Vector Search

ClickHouse: two releases this week

ClickHouse shipped v26.8.2.7-lts on Sept 1 and v26.3.32.14 on Sept 6, both routine maintenance releases on their respective LTS lines.

PostgreSQL: CVE-2026-6471 still worth checking

PostgreSQL had no new release this week, but the Aug 13 fix for CVE-2026-6471 ("PostGREShell," a 12-year-old logical-decoding RCE flaw, CVSS 7.2) in 18.6/17.11/16.15/15.19/14.24 remains recent enough that it is worth confirming your fleet is past it if you have not checked since mid-August.

MongoDB driver advisory batch

MongoDB published a cluster of driver and tooling advisories — CVE-2026-84962 through CVE-2026-84971, up to CVSS 8.2 — covering the PHP driver, C driver, C++ driver, libmongocrypt, and the VS Code extension. Check which of these components you depend on directly rather than assuming server-side patching covers it.

No release in this window was confirmed for pgvector, Redis, or DuckDB.

Database Tools, ORMs & BaaS

• Prisma published 8.0.0-rc.13 around Sept 5, continuing the release-candidate cycle for Prisma 7's config replacement.
• Supabase announced deprecation of the Management API's logs.all endpoint, with removal scheduled for Sept 23, plus a maintenance window on Sept 15 — see the Supabase changelog.
• Firebase launched usage-based Remote Config pricing with native A/B testing, and the Admin Node.js SDK moved to v14.3.0 (Sept 1) — see Firebase release notes.

Drizzle ORM showed repository activity on Sept 5 but no confirmed changelog entry was published for that date.

Background Jobs, Messaging & Task Queues

Apache Kafka 4.4.0 is targeted for release no earlier than today, Sept 9, per the published release plan — no tag was live as of writing, so treat it as pending rather than shipped. BullMQ's Python client bullmq 3.2.1 went up on PyPI Sept 1; the core JS package's last notable release remains v6.2.0 (pluggable Redis/Postgres backends, Aug 21). Temporal's Go, TypeScript, Java, and UI repos all show Sept 8 commit activity, but no tagged release or changelog entry was confirmed. No release in this window was found for RabbitMQ (latest 4.3.4/4.2.10, Aug 17).

Bottom Line

If you only patch one thing today, patch Fastify and, if you build container images from untrusted sources, Docker/Podman for CVE-2026-17106. Everything else in this roundup is routine maintenance or forward-looking — worth scheduling, not worth paging anyone over.