Dev Stack Release Audit, October 19-25, 2026: Node.js Brotli RCE Fix and TanStack Start XSS

Executive Summary

• Node.js 26.12.1, 24.22.1 and 22.23.4 (October 21) fix ten CVEs, four rated High, including a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497).
• Next.js 16.4.1 and 15.5.28 (October 14): still the must-have patches. 16.4.1 fixes two critical unauthenticated RCEs and one high-severity DoS. The use cache RCE affects only 16.x. 15.x users get the fixes that apply to them in 15.5.28: the SVG RCE and the DoS. Next.js 16.4.3 is now the latest stable.
• TanStack Start CVE-2026-102989: a critical reflected XSS in server-function responses, with patched packages on npm.
• Keycloak 26.8.1 (October 13): a security release covering privilege escalation, token exchange and OIDC logout flaws.
• Docker Engine 29.9.1 (October 14): updates containerd to 2.4.2, fixing three vulnerabilities.
• NestJS 12.2.0 (October 19): adds DoS-oriented limits for SSE, WebSockets, Kafka and TCP, and changes ValidationPipe, FileTypeValidator and middleware exclusion behavior.
• BullMQ 6.4.1 and 6.4.2: dependency security patches, including a pinned fast-uri. 6.4.0 adds reliable realtime messaging.
• Astro 7.4.2: raises its minimum Node.js to 22.23.4.
• Drizzle ORM 1.0.0-rc.5 and Prisma 8 RCs: long lists of breaking changes in pre-release.

Node.js Security Releases: Brotli RCE and TLS Hostname Bypasses

The October 2026 security releases landed on October 21 for the 26.x, 24.x and 22.x lines. The High-severity fixes are:

• CVE-2026-111497: out-of-bounds write in the Brotli decoder that permits remote code execution (26.x, 24.x, 22.x).
• CVE-2026-105482: dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
• CVE-2026-105483: TLS certificate hostname bypass when an IP is written with fullwidth digits (26.x, 24.x).
• CVE-2026-106069: TLS certificate hostname bypass when a host loosely resolves to an IP address (26.x, 24.x, 22.x).

Medium fixes include CVE-2026-106074, where crypto.randomUUID() and randomInt() entropy caches were saved into startup snapshots and single executable applications, so every process repeated the same values. Three Low-severity issues touch the ZIP reader and the Permission Model. The release also updates c-ares, OpenSSL (24.x, 22.x), SQLite (22.x) and Undici, and addresses the eMudhra intermediate CA compromise.

End-of-life lines are always affected by security releases, so anything off the release schedule should move to a supported version. For containers, rebuild on a fresh base image:

# Dockerfile
FROM node:22.23.4-slim
# or node:24.22.1-slim / node:26.12.1-slim

# rebuild without cache so the patched base is pulled
docker build --pull --no-cache -t app:patched .
node -v   # expect v22.23.4, v24.22.1 or v26.12.1

Next.js: Two Critical RCEs, Then Backports

October 14 fixes: 16.4.1 and 15.5.28

The out-of-band update, released October 14, carries fixes postponed from September because of upstream dependency delays:

• GHSA-673q-mjm6-r5xr (Critical): unauthenticated RCE in App Router apps with Cache Components when a use cache function returns multiple typed arrays. Affects only >=16.0.0 <=16.4.0; patched in 16.4.1. 15.x is not affected. There is no known workaround, and the advisory says to upgrade immediately even if your app has no such functions.
• GHSA-2464-fhr4-w9xw (Critical): unauthenticated RCE in the Image Optimization API when SVG files are used, caused by a memory issue in an upstream library, on glibc-based Linux. Affects >=10.0.0 <=15.5.27 and >=16.0.0 <=16.4.0. Patched in 15.5.28 and 16.4.1. Workaround: make sure the sharp version used by Next.js is 0.35.5 or later.
• GHSA-p3m5-59mp-jv5r / CVE-2026-94482 (High): crafted requests against App Router apps with at least one Server Action cause excessive CPU use and block further requests in the same process. Pages Router apps and apps without Server Actions are not affected. Patched in 15.5.28 and 16.4.1.

npm install [email protected]   # 16.x line: latest; 16.4.1 is the minimum for the fixes
npm install [email protected]  # 15.x line, Maintenance LTS: SVG RCE and DoS fixes

# confirm the resolved sharp version (needs >= 0.35.5)
npm ls next sharp

16.4.2 and 16.4.3

v16.4.3 (October 23) is marked Latest and does not include all canary changes. It fixes extensionless Google font URLs in both bundlers (#100277), stops loading the app-page runtime in proxy.ts (#100423), reverts a Turbopack loader invalidation update (#100438), keeps OpenTelemetry request traces together (#100542) and avoids loading standalone React in the server bootstrap (#100610).

v16.4.2 (October 15) backports turbo-tasks snapshot consistency, Pages Router dev module graph chaining, two Turbopack garbage-collection paths that could leave dependency edges partially torn down, chunk-list collisions for lazy dynamic imports, and ignoring realpath errors in module resolution to match Node.js.

On the canary track, v16.5.0-canary.15 brings Partial Prefetching and Cached Navs fixes, canary.16 passes Server Action request metadata into App rendering, and canary.17 prefetches multi-page SST blocks in turbo-persistence.

TanStack Start: Critical Reflected XSS

Per the TanStack advisory, CVE-2026-102989 lets an attacker craft a server-function URL that returns attacker-controlled HTML from your origin; the script then runs with the victim's session. Affected: versions from 1.143.12 up to the patched builds: @tanstack/react-start 1.168.60, solid-start 1.168.57, vue-start 1.168.56 and start-server-core 1.169.39. Upgrade, confirm the lockfile, and redeploy; a local update alone does not protect deployed apps.

npm update @tanstack/react-start @tanstack/start-server-core
npm ls @tanstack/start-server-core   # expect >= 1.169.39

Keycloak 26.8.1: Privilege Escalation and Token Exchange Fixes

The 26.8.1 release (October 13) follows 26.8.0 (October 1). The release page was truncated when read, so this list may not be complete:

• CVE-2026-94000: a delegated admin with only manage-users can become realm admin through a group that maps an admin role.
• CVE-2026-94001: an admin credential DELETE bypasses a denied reset-password permission.
• CVE-2026-97846: Standard Token Exchange skips required mTLS certificate binding.
• CVE-2026-18569: OIDC broker backchannel logout accepts forged, unsigned tokens when signature validation is disabled.
• CVE-2026-15943: updating an OIDC identity provider reuses a masked client secret after the token URL changes.
• CVE-2026-95503: possible KDC spoofing when Kerberos password authentication is on.
• CVE-2026-103884: path traversal via a client-supplied X.509 CRL path.

The notes also mention a weakness (#53354) that allowed unauthenticated login as an arbitrary user through the SAML broker HTTP-Redirect binding, plus several Jackson and simple-git dependency CVEs. The previous patch release, 26.7.5 (September 30), fixed CIBA and Device Authorization brute-force lockout bypasses and a client secret exposure to the view-clients role. If you run 26.7.x or older, plan the jump:

# container deployments
docker pull quay.io/keycloak/keycloak:26.8.1

# afterwards, review delegated-admin roles and group role mappings
# (CVE-2026-94000) and any client using token exchange with mTLS

Docker Engine 29.9.1: containerd 2.4.2

Per the release notes, the 29.9.1 release (October 14) moves the bundled containerd to v2.4.2, and it was still the latest Engine release in those notes when checked on October 20:

• CVE-2026-95839: a malformed digest in a child descriptor can crash containerd when pulling or importing an image.
• GHSA-8647-2jxj-p2rc: a crafted Content-Length header from an untrusted registry can crash containerd with parallel layer fetching enabled.
• GHSA-hc94-p972-ch66: a crafted image can exhaust host disk because layer data was not capped at the declared size.

Other fixes: --link-local-ip no longer accepts non-link-local addresses (which stopped containers starting), docker ps -s no longer fails when one container's size can't be computed, a daemon panic with the fluentd log driver (async mode, unreachable TLS address) is fixed, and RootlessKit is updated to v3.3.0. Hosts that pull from third-party registries should prioritize it.

docker version --format '{{.Server.Version}}'   # expect 29.9.1
docker info --format '{{.ContainerdCommit.ID}}'

BullMQ 6.4.0, 6.4.1 and 6.4.2

6.4.1 (October 23) updates security patches (#4986) and 6.4.2 (October 24) pins fast-uri to a patched version (#5009). The release pages give no further detail. 6.4.0 (October 21) adds support for reliable realtime messaging (#4904); read the linked issue for the API before adopting it in production.

npm install [email protected]
npm ls fast-uri

NestJS 12.2.0: New Limits and Behavior Changes

The 12.2.0 release (October 19) is mostly hardening. New options cap resource use: @Sse({ maxPendingDataLength }) (4M characters default), maxConcurrentMessages on the Socket.IO and ws adapters (1000), maxErrorMessagesLength on ValidationPipe, Kafka parser.maxMessageSize (16 MiB; larger messages are logged and skipped) and a TCP drainTimeout (30 s). Express and Fastify now default fieldNestingDepth to 32 and fieldArrayIndexLimit to 1000 for uploads.

Behavior changes to test before upgrading:

• ValidationPipe defaults to validationError.target: false, so error.target is undefined inside a custom exceptionFactory, and it returns 400 when an array or primitive is sent for a validated class.
• FileTypeValidator string matching is now exact to the end of the name: font/woff no longer accepts font/woff2.
• Middleware exclude() follows the router's case and trailing-slash matching; update core and platform packages together.
• A global enhancer that fails to instantiate now stops startup, and request- or transient-scoped APP_FILTER providers log a startup warning.

If you relied on prefix-style file type matching, switch to a RegExp:

new ParseFilePipe({
  validators: [
    // exact string matching is now stricter; use a RegExp for prefixes
    new FileTypeValidator({ fileType: /^font\/woff2?$/ }),
  ],
});

Astro 7.4.1 and 7.4.2

Astro 7.4.2 (October 21) is a patch release, but one change affects your toolchain: the minimum supported Node.js version is now 22.23.4 (#18475), which pulls in the October security fixes. Other changes:

• Content sync with experimental.collectionStorage: "chunked" is much faster; the chunking step on a ~44k-entry store drops from about 60 seconds to under one (#18430).
• astro dev with @astrojs/cloudflare no longer fails with a require error for node-fetch (#18438).
• A stale lock file with a Linux thread ID is no longer treated as a running server, which could make astro dev stop or --force kill an unrelated process (#18376).
• astro sync, astro check and astro build no longer replace a running dev server's optimized dependencies (#18451).
• defineConfig() types for i18n.defaultLocale, i18n.fallback and i18n.domains now accept a locale's path (#18467).

If you pin Node in CI, update it alongside Astro:

{
  "engines": { "node": ">=22.23.4" }
}

Astro 7.4.1 (October 19) fixes TSCONFIG_ERROR failures when a parent tsconfig cannot be resolved, missing styles for conditionally rendered framework components inside hydrated islands, dev-server memory growth when editing the config, and project paths containing an apostrophe.

Drizzle ORM 1.0.0-rc.5: Breaking Changes Before 1.0

1.0.0-rc.5 (October 21) is a release candidate, so pin it deliberately. The notes list many breaking changes (the page was truncated, so read the full notes before upgrading):

• Relational query where now throws on undefined. Use the new EmptyFilter export to mark an optional filter explicitly.
• An empty relation filter such as posts: {} is skipped instead of checking existence. Use true or false to filter by presence.
• withReplicas sends queries to the primary by default. Use db.$replica to read from a replica.
• DrizzleQueryError omits params unless you pass paramsInErrors: true.
• Relational queries are cached by caches using the all strategy. Opt out with withCache: false.
• The relational query builder (RQBv2) has a new build strategy that can break raw SQL referencing relation aliases. Opt out per query with strategy: 'basic'.
• postgres-js: transparent parsers no longer conflict with the driver's serializers for timestamp, date, time and JSON. Remove manual JSON.stringify workarounds.

// before: silently ignored undefined
db.query.users.findMany({ where: { id: maybeId } });

// rc.5: throws on undefined
db.query.users.findMany({ where: { id: maybeId ?? EmptyFilter } });

// read from a replica explicitly
const rows = await db.$replica.select().from(users);

The snippet illustrates the documented behavior; confirm exact import paths and signatures against the release notes.

Prisma 8 Release Candidates

npm lists 8.0.0-rc.27 as the newest build, with rc.24 published on October 21. The release page read for these audits stopped at rc.20, so later builds are not summarized here. rc.20 (October 22) changed that piped ORM commands print data lines instead of JSON, so scripts that parse output need the --json flag, and contracts store a column's real type, which changes storage hashes for contracts that used type aliases. Across the train, the notable direction is:

• @default now means a database default; generated values move to @onCreate(...) and @onUpdate(...).
• Every schema file needs // use prisma-8 as its first line, and prisma.config.ts must import definePrismaConfig.
• dbgenerated(...) is removed in favor of sql literals, and --confirm no longer consents to data loss (use --delete or --rename).
• A model without @@map uses its name as written; run the add-model-map script first.

Nuxt 4.6.2

Nuxt 4.6.2 (October 16) is a fix-only release of about 30 items: server island head tags follow useHeadSafe rules, server route rules match case-insensitively unless routing is sensitive, error state survives aborted navigation, and dev overlays replay only to newly loaded pages.

Vercel: AI Gateway and Terms Updates

On October 18 Vercel added session affinity to AI Gateway logs, and on October 19 it published updates to the Hobby and Pro Terms of Service. New models also arrived on AI Gateway, per the Vercel changelog. If you run on those plans, read the terms change.

Other Registry Activity

Published on npm with release notes not reviewed, so read the changelogs before upgrading: SvelteKit 3.1.0 (October 14), Motion 14.6.0, Better Auth 1.7.12, Clerk Next.js SDK 7.9.20, Wrangler 4.152.0 and Elysia 2.0.0-rc.0.

Action Checklist

1. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images with --pull.
2. Confirm Next.js is on 16.4.1+ (ideally 16.4.3) on the 16.x line or 15.5.28 on the 15.x line, with sharp at 0.35.5 or later.
3. Upgrade TanStack Start packages and redeploy.
4. Move Keycloak to 26.8.1 and review delegated-admin group mappings.
5. Roll Docker Engine 29.9.1 across build and registry-pulling hosts.
6. Bump BullMQ to 6.4.2.
7. Test NestJS 12.2.0 behavior changes before upgrading, and bump CI Node versions before upgrading Astro to 7.4.2.
8. Hold Drizzle 1.0 RC and Prisma 8 RC upgrades to a branch until you have read the breaking-change lists.

Coverage varied by day in this window. Kubernetes, Cloudflare and database engines had no verified changes, so they are omitted rather than guessed.

Sources

• Node.js October 2026 security releases
• Node.js release schedule
• Next.js security update, October 14
• Next.js v15.5.28 release
• Next.js v16.4.3 release
• Next.js v16.4.2 release
• Next.js releases
• TanStack Start advisory
• Keycloak releases
• Docker Engine release notes
• BullMQ releases
• NestJS v12.2.0 release
• Astro releases
• Astro 7.4.1 release
• Drizzle ORM releases
• Prisma releases
• Nuxt v4.6.2 release
• Vercel changelog