Dev Stack Release Audit, October 12-18, 2026: Next.js 16.4.1 Critical RCE Fixes and Docker Engine 29.9.1

Executive Summary

• Next.js 16.4.1 and 15.5.28 (critical): the October 14 out-of-band update. 16.4.1 fixes two critical unauthenticated RCEs (GHSA-673q-mjm6-r5xr in use cache and GHSA-2464-fhr4-w9xw in SVG image optimization) and a high-severity Server Actions DoS. The use cache RCE affects only 16.x. 15.x users get the fixes that apply to them in 15.5.28: the SVG RCE and the DoS. Next.js 16.4.2 is the current stable patch. Confirm sharp resolves to 0.35.5 or later.
• CVE-2026-75604 (CVSS 9.0): a third-party analysis reports exploitation of a Server Actions key exposure on Windows-hosted Next.js, with a public Metasploit module.
• Docker Engine 29.9.1: moves containerd to 2.4.2 to fix three vulnerabilities, including host disk exhaustion from unbounded layer data.
• Express 5.3.0: bumps qs, proxy-addr (CVE-2026-90711) and body-parser (CVE-2026-12590). An invalid body-parser limit now throws instead of silently disabling size enforcement.
• Node.js: a security release is pre-announced for October 21 on 26.x, 24.x and 22.x, with HIGH as the top severity. 26.12.0 and 24.22.0 shipped October 14 and are not security releases.
• Redis 8.10.2, 8.8.3 and 8.6.7: still worth checking, for an ACL bypass in queued transactions and unauthenticated cluster bus traffic.
• Next.js 16.4: recommends Cache Components for every app and flips several defaults, including strict route matching.

Next.js: Security First

October 14: 16.4.1 and 15.5.28

As announced on October 8, the out-of-band update landed on October 14, when 16.4.1 and 15.5.28 were released. It is documented in the official security update:

• GHSA-673q-mjm6-r5xr (Critical): unauthenticated RCE in use cache functions that return multiple typed arrays, on App Router with Cache Components. Affects only >=16.0.0 <=16.4.0; patched in 16.4.1. 15.x is not affected. There is no known workaround, and the advisory says to upgrade immediately even if your app has no such functions.
• GHSA-2464-fhr4-w9xw (Critical): unauthenticated RCE in the Image Optimization API when SVG files are used, on glibc-based Linux, which covers most Debian and Ubuntu Docker images. Affects >=10.0.0 <=15.5.27 and >=16.0.0 <=16.4.0. Patched in 15.5.28 and 16.4.1. The workaround is sharp 0.35.5 or later.
• GHSA-p3m5-59mp-jv5r / CVE-2026-94482 (High): denial of service in the App Router via Server Actions, through CPU exhaustion. Pages Router apps and apps without Server Actions are not affected. Patched in 15.5.28 and 16.4.1.

Next.js 15.5.28 gives 15.x users the two fixes that apply to them: the SVG RCE and the Server Actions DoS. Separately, Next.js 15 LTS reaches end of security support on October 21 per endoflife.date, so plan the jump to 16 on that timeline.

Upgrade, then confirm the resolved sharp version. Third-party coverage reports that Next.js 15.x still accepts sharp ^0.34.3, so an old lockfile entry can survive the upgrade; verify it yourself:

npm install [email protected]   # 16.x line
npm install [email protected]  # 15.x line, security support ends 21 Oct
npm ls sharp
npm install sharp@^0.35.5

Severity scores differ between secondary sources, so rely on the official advisory. For context, an earlier sharp advisory on inherited libvips flaws is tracked as GHSA-f88m-g3jw-g9cj, and Netlify published a summary of the update.

CVE-2026-75604: Server Actions key exposure on Windows

A third-party analysis of CVE-2026-75604 reports that an encoded ..%5C in a route segment can escape the cache folder and expose server-reference-manifest.json, which holds the Server Actions encryption key. With it, an attacker can forge Server Action values and, via the public Metasploit module, reach remote code execution as the Node.js process.

Affected: Next.js 13.4.0 up to 15.5.24 and 16.3.3 on Windows-hosted servers (Vercel states Linux and macOS are not affected). The write-up recommends 15.5.26 or 16.3.6, notes there is no patched 13.x or 14.x line, and reports exploitation as recently as September 24. Treat these details as secondary-source until you confirm them against the official Vercel advisory.

Recommended response: block backslash patterns at your WAF while patching, upgrade, delete the build cache so a fresh key is generated, then rotate the key:

npm install next@latest
rm -rf .next/cache/.rscinfo   # or remove .next entirely
next build
# If you pin the key, set a NEW value and redeploy every instance:
# NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=<new-base64-key>

Next.js 16.4.2

Next.js 16.4.2 shipped on October 15 as the latest stable release, with no new advisories. It is mostly Turbopack backports: snapshot consistency fixes, lazy dynamic-import chunk-list collisions, Pages Router dev graph fixes, and module resolution that now ignores realpath errors like Node does. The 16.5.0 canary line is moving daily and reached canary.17 on October 17. Canaries are pre-releases, so keep them out of production.

Next.js 16.4: what changed

The 16.4 release (October 6) recommends Cache Components for every app. It becomes the default in Next.js 17, and new apps from create-next-app already have it on. It also ships React 19.3.

import type { NextConfig } from 'next';

const nextConfig: NextConfig = {
  cacheComponents: true,
  partialPrefetching: true,
  experimental: { agentUpgrade: 'security' },
};

export default nextConfig;

New ensureStatic fails the build if dynamic content sneaks into a route that should stay static:

export const ensureStatic = 'navigation'; // or 'prefetch' | 'shell'

export default async function RootLayout({ children }) {
  // ...
}

And await navigation() defers expensive cached work until a real navigation instead of a prefetch:

import { navigation } from 'next/cache';

async function Thread({ id }) {
  await navigation(); // excluded from prefetch
  const thread = await getThread(id);
  // ...
}

Default and behavior changes from the 16.4.0 release notes, which list PR titles only, so check each PR before relying on details:

• Strict route matching is now default, and legacy PPR code paths and the experimental appNewScrollHandler option are gone.
• The Pages Router deprecates React 18 support, and AVIF image optimization is re-enabled.
• Turbopack turns on export name mangling and the shared runtime for production builds. Its disk cache is 20-25% smaller (Zstandard), server HMR is lazy, and production CSS Module class names are shorter.
• next upgrade --agent and experimental.agentUpgrade (default policy 'security') nudge you toward security-relevant upgrades. Experimental flags include turbopackGc, turbopackLazyDynamicImports and a Rust React Compiler.

React 19.3.1 and Backports

React 19.3.1, 19.2.9, 19.1.10 and 19.0.9 improve the Server Components transport protocol across all supported lines (PR #37845). The release notes list no security fixes, but because they shipped alongside the Next.js patch, keep React and Next.js versions aligned and rebuild your lockfile:

npm install [email protected] [email protected] [email protected]

Docker Engine 29.9.1 and Docker Desktop 4.95.0

Per the Docker Engine release notes, 29.9.1 (October 14) bundles containerd v2.4.2, which addresses a crash from a malformed digest in a child descriptor, a crash from a crafted Content-Length header with parallel layer fetching, and possible host disk exhaustion from unbounded layer data. Pulling images from untrusted registries is the exposure to care about.

• Fixes: --link-local-ip now rejects non-link-local addresses, docker ps -s no longer fails when one container's size cannot be computed, and docker save no longer leaves layers behind for repeated layers.
• Networking and rootless: firewalld docker zone handling is adjusted, bridge network restoration on daemon start is fixed, and RootlessKit moves to v3.3.0.

29.9.0 (October 8) brought a Go runtime update for HTTP/2 and Windows junction vulnerabilities, BuildKit v0.34.0 and a lazy-pull daemon feature.

Docker Desktop 4.95.0 (October 12) is a stability release:

• The engine no longer restarts after startup when an admin policy enables Enhanced Container Isolation.
• Auto-update downloads no longer start before sign-in on machines that enforce it, closing a policy bypass.
• The Windows installer no longer deletes the WSL data disk when the data root sits inside the install directory.
• A new docker desktop auth status subcommand shows Docker Hub login details.

docker version --format '{{.Server.Version}}'   # expect 29.9.1
docker info | grep -i containerd
docker desktop auth status

Express 5.3.0: Dependency Security Fixes

Express 5.3.0 was published on October 9. The security-relevant changes are dependency upgrades: qs to ^6.16.0 (arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer), proxy-addr to ^2.0.8 for CVE-2026-90711, and body-parser to ^2.3.0 for CVE-2026-12590. Verify the CVE IDs against the CVE database before triaging.

The body-parser change can break startup if you pass a malformed limit, because previously an invalid value silently turned size enforcement off. Use a valid size string:

import express from "express";
const app = express();
// An invalid limit such as "10 megs" now throws at init
app.use(express.json({ limit: "1mb" }));

Other changes: req.fresh handles QUERY requests, res.redirect() HTML bodies include a doctype, the default error handler logs the full error including Error.cause, and content-disposition v2 no longer quotes token-safe filenames, which can break tests asserting exact header bytes. Upgrade with:

npm install [email protected] && npm audit

Node.js: Prepare for October 21

The pre-announcement states that 26.x, 24.x and 22.x are affected, with HIGH the highest severity fixed. CVE IDs and patched versions are not yet published. End-of-life lines are also affected and will not receive fixes. Reserve a patch window for October 21 and watch the Node.js vulnerability index.

Node.js 26.12.0 (Current) and 24.22.0 'Krypton' (LTS) shipped on October 14 and are not listed as security releases. 24.22.0 adds crypto.parsePKCS12(), SIV/GCM-SIV cipher modes, a generic MAC API, util.throttle and util.debounce. 26.12.0 adds http websocket mask helpers. Pin the LTS line in production images:

FROM node:24.22.0-bookworm-slim
# glibc base: make sure sharp >= 0.35.5 if you run next/image

Node.js 24 moves to Maintenance LTS on October 20 and Node.js 26 to Active LTS on October 28, per the NodeSource weekly. Next.js currently falls back to child processes for Turbopack worker threads on Node.js 24.13.1 and newer because of an upstream Node.js bug.

Redis and Django: Earlier Security Fixes

Redis 8.10.2, 8.8.3 and 8.6.7 (September 17) fixed ACL bypass in queued transactions and unauthenticated cluster bus traffic, adding cluster-bus-port-protected-mode. If you have not patched, do it now.

Django published four security fixes on October 6 for 6.1, 6.0 and 5.2; see the Django security archive.

NestJS 12.1.3

NestJS 12.1.3 (October 12) is a bug-fix release. Request-scoped global enhancers now fail at startup instead of being silently dropped, and the shutdown sequence runs after a failed init. SSE handling is hardened (headers, early disconnects, empty streams), Redis no longer crashes when its connection drops, and Kafka tombstone null payloads are preserved. Teams on RabbitMQ, NATS, MQTT or gRPC transports also receive fixes. The Fastify adapter honors return503OnClosing during shutdown, and both adapters gained limits on field nesting and array indexes in file uploads.

SvelteKit 3.1.0

SvelteKit 3.1.0 adds the CSP report-sha256, report-sha384 and report-sha512 keywords and emits a sveltekit.endpoint span for +server handlers when server tracing is on. Fixes include server-only module detection inside a server directory, prerendered MIME type inference and focus handling in unfocused iframes. Pair it with adapter-vercel 7.0.1 and adapter-cloudflare 8.0.1.

// illustrative: where the new keyword goes
const config = {
  kit: {
    csp: {
      directives: {
        'script-src': ['self', 'report-sha256']
      }
    }
  }
};

Confirm the exact syntax and config location in the SvelteKit CSP docs before deploying.

Nuxt 4.6.1

Nuxt v4.6.1 (October 9) ships one performance change and about 25 fixes across Vite, Nitro, Kit and hydration. It defers Nitro's portable event web view until first access, registers dev handlers once, and fixes dependency scanning on virtual imports. Other notable fixes: setPageLayout accepting false, $fetch and baseURL typing, nitropack/types under nodenext, Windows path resolution in Nitro, a BroadcastChannel fallback, and preserving onServerPrefetch for useId during hydration.

Docker Compose 5.6.0

The 5.6.0 release (October 2) adds partial job support (only manually-triggered jobs for now), new provider-service requests and a network relay, coalesces watch rebuilds during bursts of file changes, honors --parallel across bulk operations, and removes dangling images on down. The previous 5.5.0 release warned that containers may be recreated on first up after upgrading because of image-digest reconciliation changes.

Pre-Releases to Watch

• Prisma 8: Prisma 8.0.0-rc.18 (October 14) requires sql literals for raw SQL in a contract, supports multi-field weighted full-text indexes, and adds whereUnique and firstOrThrow to the SQL ORM. Every schema file needs a // use prisma-8 header, so test migrations on a branch first. npm separately lists 8.0.0-rc.22 with an October 8 date, so the GitHub and npm numbering do not line up; check both before pinning. The changelog shows ORM 8 still at release candidate, with a stable release expected in October.
• Hono 5: v5.0.0-rc.1 was tagged on October 10. The release page carries no notes, so breaking changes are not yet documented; hold off on upgrading production services. The stable line on npm is still 4.13.13.
• Elysia 2: 2.0.0-beta.28 through beta.30 landed October 9 and 10 while 1.4.30 remains latest.
• Vue 3.6: 3.6.0-rc.11 was published on October 10. Details live in the CHANGELOG on the minor branch; the npm latest tag is still 3.5.43.
• Kubernetes: v1.37.1 (September 23) remains the latest stable patch, alongside 1.36.5, 1.35.9 and 1.34.12. v1.38.0-alpha.2 (October 7) is a pre-release; keep it out of production clusters.

Other Releases

• MUI 9.5.0 (October 9): getOptionValue for Autocomplete so options can be primitive values, fixes for Tabs, Slider, Select and Snackbar, and theme.alpha() with CSS variables.
• Astro: the Vue, Svelte and React integrations now require Node.js 22.22.0 or newer (releases). Check CI images before upgrading.
• Keycloak 26.8.1: patch release on October 13, following 26.8.0 (October 1), which moved SCIM and Multi-Cluster v2 to supported. Read the release page before rolling out.
• Drizzle ORM 0.45.4: fixes explicit prepared queries on postgres-js (releases).
• Motion 14.1.0 (October 9): tagged without published notes.

These come from npm registry metadata only, with changelogs not reviewed, so treat them as version bumps to evaluate: Better Auth 1.7.9 (October 15), BullMQ 6.3.15 (October 14), Fastify 5.12.7 (October 13), Astro 7.3.8 (October 8), Auth0 7.4.0 (October 9) and Clerk Next.js SDK 7.9.14.

Action Checklist

1. Upgrade Next.js to 16.4.2 on the 16.x line or 15.5.28 on the 15.x line, with matching React patches, and confirm sharp is 0.35.5 or later.
2. If you host Next.js on Windows, work through the CVE-2026-75604 steps and rotate the Server Actions key.
3. Roll Docker Engine 29.9.1 to hosts and CI runners that pull third-party images, and roll out Docker Desktop 4.95.0.
4. Upgrade Express to 5.3.0 and check body-parser limits before deploying.
5. Reserve a patch window for the Node.js October 21 security release, and plan Next.js 15 apps off the 15 line before security support ends on October 21.
6. Confirm Redis is on a patched 8.x line and Astro CI uses Node 22.22.0 or newer.

Coverage varied by day in this window. PostgreSQL, MongoDB, ClickHouse, DuckDB, Authentik, Laravel, Kafka, RabbitMQ and Temporal could not be verified, so they are not reported as unchanged.

Sources

• Next.js security update, October 14
• Next.js upcoming security update announcement
• Next.js v15.5.28 release
• Next.js v16.4.2 release
• Next.js v16.4.0 release
• Next.js 16.4 announcement
• Empirical Security analysis of CVE-2026-75604
• Netlify changelog
• endoflife.date Next.js
• React 19.3.1 release
• Docker Engine release notes
• Moby docker-v29.9.1 release
• Docker Desktop release notes
• Express v5.3.0 release
• Node.js October 2026 security releases
• Node.js v26.12.0 release
• Node.js v24.22.0 release
• NodeSource weekly
• Redis releases
• Django security archive
• NestJS v12.1.3 release
• SvelteKit releases
• Nuxt v4.6.1 release
• Docker Compose releases
• Prisma releases
• Prisma changelog
• Hono v5.0.0-rc.1
• Vue v3.6.0-rc.11
• Kubernetes releases
• MUI v9.5.0 release