Dev Stack Release Audit, October 26-31, 2026: Node.js 26 LTS and the Next.js November 3 Security Release

Executive Summary

• Node.js 26.12.1, 24.22.1 and 22.23.4: still open if unpatched. The October 21 releases fix 10 CVEs, four rated High, including a Brotli decoder flaw (CVE-2026-111497) and two TLS hostname-check bugs. Node.js 26.13.0 then moves the 26.x line to LTS with metadata changes only.
• Next.js: a security release covering seven medium-severity vulnerabilities was scheduled for Tuesday, November 3 when this was written. The October 14 critical fixes still apply: 16.4.1 fixes both RCEs on 16.x, and 15.5.28 fixes the SVG RCE on 15.x. Next.js 15 maintenance ended October 21.
• Nuxt 4.6.3 (October 27): five security fixes covering dev-server file reads, Nitro dev output exposure, the generated app secret, dot-segment paths and redirect route rules on islands.
• PgBouncer 1.26.1: fixes three CVEs including an authentication bypass (CVE-2026-107350). PostgreSQL 19 RC1 is also out.
• Docker Engine 29.9.2 (October 20): rejects certificate chains containing eight revoked eMudhra intermediates (CVE-2026-111943).
• Keycloak 26.8.1 (October 13): remains the patch to be on, fixing roughly 20 CVEs.
• SvelteKit 3.1.1 and Wrangler 4.156.0: trust-boundary fixes for cross-origin route resolution and autoconfig asset uploads.
• Kubernetes v1.37.2, v1.36.6, v1.35.10 and v1.34.13 (October 28): patch releases on all four supported minor lines.

Node.js: Security Releases, Then 26 Goes LTS

Confirm the October 21 fixes

The October 2026 security release patches the 26.x, 24.x and 22.x lines. The four High-severity issues are:

• CVE-2026-111497: zlib, the bundled Brotli decoder, out-of-bounds write that is potentially RCE (26.x, 24.x, 22.x).
• CVE-2026-105482: dns.resolve*() and dns.reverse(), names truncated at a NUL byte (26.x, 24.x, 22.x).
• CVE-2026-105483 and CVE-2026-106069: tls.checkServerIdentity() IP identity checks (the first affects 26.x and 24.x, the second all three lines).

The three Medium issues cover http Agent keep-alive socket reuse, TLS hostname verification and crypto randomness helpers (randomUUID, randomUUIDv7, randomInt). The three Low issues touch zlib.ZipFile and the Permission Model. The release also bumps c-ares, OpenSSL, SQLite and Undici and removes a compromised eMudhra intermediate CA. End-of-life lines are always affected, so Node 25, 23, 21 and 20 users must move to a supported line. Images built before October 21 keep the old runtime until rebuilt on a fresh base pull.

node --version   # want v26.12.1, v24.22.1 or v22.23.4
nvm install 24 --latest-npm
# Containers: pin the patched tag
# FROM node:24.22.1-slim

Node.js 26.13.0 "Lithium"

The v26.13.0 release is the LTS promotion for the 26.x line, with support through April 2029. The only differences from 26.12.1 are metadata, such as process.release now reporting LTS status. It lists no new features and no security fixes. Since Node.js 25, official Linux binaries link against libatomic, so teams coming from 24 or 22 may need to install it on minimal distributions.

# Pin to the 26 LTS line and make sure libatomic exists on slim images
FROM node:26-slim
RUN apt-get update && apt-get install -y --no-install-recommends libatomic1 && rm -rf /var/lib/apt/lists/*

# Or locally
nvm install 26 && node -p "process.release.lts"

Next.js: November 3 Release and the 15 End of Life

The November 3 security release

The advance notice from October 27 said seven medium-severity vulnerabilities would be fixed on Tuesday, November 3, with full advisories published alongside. That was the schedule when this was written, so check the notice and compare your lockfile against the current release:

npm ls next react react-dom
npm view next dist-tags --json   # compare 'latest' with your lockfile

October 14 fixes and Next.js 15

Next.js 16.4.1 and 15.5.28 were released on October 14, per the security update:

• GHSA-673q-mjm6-r5xr (Critical): unauthenticated RCE in App Router apps with Cache Components when a use cache function returns multiple typed arrays. Affects only >=16.0.0 <=16.4.0; patched in 16.4.1. 15.x is not affected. There is no known workaround, and the advisory says to upgrade immediately even if your app has no such functions.
• GHSA-2464-fhr4-w9xw (Critical): unauthenticated RCE in the Image Optimization API when SVG files are used. Affects >=10.0.0 <=15.5.27 and >=16.0.0 <=16.4.0. Patched in 15.5.28 and 16.4.1.
• GHSA-p3m5-59mp-jv5r / CVE-2026-94482 (High): denial of service in the App Router via Server Actions. Patched in 15.5.28 and 16.4.1.

Two of those fixes slipped from the September release because of upstream coordination, per the announcement. Separately, Next.js 15 maintenance ended October 21, so plan the move to 16 now.

npm install [email protected] react@latest react-dom@latest   # current stable; 15.5.28 for the 15.5 line
npx next build

16.4.3 and the 16.5 canaries

v16.4.3 (October 23) is the latest stable on npm. It fixes extensionless Google font URLs in both bundlers, keeps OpenTelemetry request traces together, and stops proxy.ts loading the app-page runtime. See the Next.js 16.4 announcement for the line's main changes.

The 16.5.0 canary line is still moving (npm) and reached canary.34 on October 30. v16.5.0-canary.30 (October 28) includes:

• jsonwebtoken replaced by fast-jwt (#100818).
• A new experimental flag, experimental.hydrationChangeEvent (#99610).
• A fix for the server reference transform on export const foo = function bar(){} (#100830).
• Agent Feedback now includes model metadata and ships a CLI for reviewing it.

// next.config.ts
import type { NextConfig } from 'next'

const config: NextConfig = {
  experimental: {
    hydrationChangeEvent: true, // canary only
  },
}

export default config

Canary builds are not for production.

Nuxt 4.6.3: Five Security Fixes

The 4.6.3 patch (October 27) hardens the dev server: it no longer reads files named in client error reports, blocks access to Nitro dev output and stops serving the generated app secret in development. Nitro and Nuxt now handle dot segments in request paths, and redirect route rules apply to page islands. Nitropack moves to 2.13.5. Performance work skips compiling plain style blocks in the server build and avoids unneeded typed-routes generation.

Behavior fixes worth knowing: useCookie no longer rewrites values on refresh, and navigateTo only returns redirects while middleware runs. Upgrade, especially if a dev server is reachable beyond localhost:

npm install [email protected]
npx nuxt upgrade --dedupe

PostgreSQL 19 RC1 and PgBouncer 1.26.1

PgBouncer 1.26.1 (October 14) fixes three CVEs, including the authentication bypass CVE-2026-107350, and psqlODBC 18.00.0005 fixes CVE-2026-109448; both are listed in the PostgreSQL news archive. PostgreSQL 19 RC1 is out for testing, and ecosystem tools such as pg_hint_plan 1.9.0 already declare compatibility. The next minor release is due November 12, 2026, which is also the final release for PostgreSQL 14.

Docker Engine 29.9.x

Docker 29.9.2 (October 20) updates the Go runtime to 1.26.10. That rejects certificate chains that include eight revoked eMudhra intermediate certificates (CVE-2026-111943). If a private registry's chain relies on them, pulls and pushes can fail TLS verification and the registry needs a new chain.

Docker 29.9.1 (October 14) updated containerd to v2.4.2 for three containerd vulnerabilities and fixed a docker save layer leak. Docker 29.9.0 (October 8) added a lazy-pull daemon feature for remote snapshotters. Engine 25 reaches end of life on 2026-12-04, per the Docker Engine lifecycle table.

docker version --format '{{.Server.Version}}'
docker pull your-registry.example.com/app:latest  # confirm TLS still verifies after upgrading

Keycloak 26.8.1

Keycloak 26.8.1 (October 13) is security-focused and fixes roughly 20 CVEs. Fixes include:

• CVE-2026-18569: the OIDC broker backchannel logout accepted forged logout tokens when signature validation was disabled.
• CVE-2026-97846: Standard Token Exchange issued an active bearer token without the required mTLS certificate binding.
• CVE-2026-94001: admin credential deletion bypassed the denied reset-password permission.
• CVE-2026-95503: potential KDC spoofing with Kerberos password authentication.
• A SAML broker HTTP-Redirect signature issue that could allow unauthenticated login as an arbitrary user.

Keycloak 26.8.0 (October 1) promoted OID4VCI to preview and added token exchange delegation for clients such as AI agents. If you are on 26.7.x or earlier, move to 26.8.1.

SvelteKit 3.1.1: Trust-Boundary Fixes

The 3.1.1 release (October 29) is 11 patch changes. The release notes do not label any of them as advisories, but several touch trust boundaries: server-side route resolution no longer loads code from another origin for pathnames starting with //, server-only modules can no longer be pulled into browser code through src/params.js, and remote form submissions are now parsed in linear time. Other fixes: a malformed pathname rewritten by reroute now returns a 400 instead of throwing, query.batch functions that are separate and not exported no longer share a batch, and the dev server reuses the original fetch across reloads.

If you use a reroute hook, check how it handles malformed input after upgrading.

npm install @sveltejs/[email protected]
npx svelte-kit sync

Cloudflare Wrangler 4.153 to 4.156

4.156.0: safer autoconfig

4.156.0 (October 29) fixes a path comparison bug that stopped autoconfig from writing a protective .assetsignore when it used the project root as the static assets directory, so files such as .env and .git could be uploaded. The generated file now covers more paths, and non-interactive autoconfig exits with an error when a root holds both static files and a Pages functions directory. If you previously ran autoconfig on a project root, review what was uploaded and rotate anything sensitive that may have been included.

The experimental wrangler d1 insights command now runs across every database in the account when no name is given, and fails with a clear message (including the Account Analytics: Read permission) instead of printing an empty list. Durable Object self-references are fixed in @cloudflare/vitest-plugin and container validation.

4.155.0: remote Analytics Engine bindings

4.155.0 (October 28) adds remote Analytics Engine bindings in local development, tail output that renders terminal control characters as visible text, preserved Flagship flag metadata on update, and UTF-8 validation of .assetsignore before building asset manifests.

// wrangler.jsonc: send local Analytics Engine writes to the real dataset
{
  "analytics_engine_datasets": [
    { "binding": "EVENTS", "dataset": "app_events", "remote": true }
  ]
}

npx wrangler d1 insights   # experimental: top queries across all D1 databases

4.153.0: secrets file behavior change

Per the release notes (October 26), deploy, versions upload and preview now expand $VAR and ${VAR} in --secrets-file, with process environment values overriding file keys. An unset reference becomes an empty string, so secrets containing a literal $ need escaping or a JSON secrets file. wrangler dev gains --infer-origin-from-routes, which you can set to false to keep the real localhost origin for CORS and Host checks.

# keep localhost origin instead of rewriting to the route host
npx wrangler dev --infer-origin-from-routes=false

# literal $ in a dotenv secret must now be escaped
API_KEY=pa\$\$word

The release also bumps Undici to 7.30.1 (GHSA-xjj6-f33q-929c, malformed responses crashing dev tools) and Zod to 4.6.6 (GHSA-mrhx-c7xc-m3w5, excessive memory use), makes local kv key list return all keys, and sets the default compatibility date to 2026-10-23.

NestJS 11.2.8: Input and Error Hardening

NestJS 11.2.8 (October 23) gives the v11 patch line the same hardening landed in v12.2.0 (October 19): ParseArrayPipe rejects non-numeric and nested-array items, ValidationPipe rejects arrays and primitives sent for validated classes, middleware exclusion matching is tighter, and internal error messages no longer reach clients through StreamableFile errors or SSE error events. Clients that stop reading an SSE stream are now dropped. On v12, new limits are configurable, for example:

app.useGlobalPipes(new ValidationPipe({ maxErrorMessagesLength: 20, whitelist: true }));

Watch for stricter FileTypeValidator matching on v12 (font/woff no longer accepts font/woff2).

Better Auth 1.7.12 to 1.7.14

The important one is 1.7.12 (October 20), which is action-required: ID token sign-in now rejects providers with no clientId, the JWT plugin verifies with the stored key's algorithm, OIDC/SSO flows reject ID tokens missing exp or iat, and requireMcpAuth accepts only OAuth access tokens. Make sure every client ID is configured:

socialProviders: { google: { clientId: process.env.GOOGLE_ID!, clientSecret: process.env.GOOGLE_SECRET! } }

1.7.13 (October 25) fixes type-only exports so wrong value imports fail at type-check time, adds token endpoint auth options for the Vercel and Cloudflare providers, and supports Stripe SDK v23. 1.7.14 (October 26) lets TOTP accept imported Base32 secrets with a base32: prefix, and Kakao sign-in passes loginHint; no security items were listed. 1.8.0-beta.2 changes provider profile types.

Kubernetes v1.37.2 and Three Backports

All four supported minor lines received patch releases on October 28: v1.37.2, v1.36.6, v1.35.10 and v1.34.13. A v1.38.0-alpha.3 pre-release shipped the same day. The release page defers to the v1.37 changelog for details, so read it before rolling out.

# Check what your clusters run, then compare with the new patch versions
kubectl version
kubectl get nodes -o custom-columns=NAME:.metadata.name,KUBELET:.status.nodeInfo.kubeletVersion

Patch releases within a minor line are the safe upgrade path. Upgrade the control plane first, then nodes, one minor line at a time.

React and Hono

• React: the October 14 patch releases (19.3.1, 19.2.9, 19.1.10, 19.0.9) improve the Server Components transport protocol. React 19.3.0 (September 9) added <ViewTransition /> and Fragment refs. Upgrade within your minor line.
• Hono 4.13.14: the release (October 25) restricts serve-static to GET and HEAD, honors Accept-Encoding q-values for precompressed files, keeps the first value for duplicate path params in the trie router, and lets bearer-auth's MessageFunction return a Response. v5.0.0-rc.1 (October 10) is accepted in the hono peer range.

BullMQ 6.5.0 to 6.5.3

• 6.5.3 (October 31) clears the ended status when connect() reopens a node-redis client, which matters if your workers reconnect after a Redis restart.
• 6.5.2 (October 30) formats exclusive time bounds in the relay without precision loss.
• 6.5.1 (October 28): flows now defer releasing the parent until all children are added, fixing issue #4944 in the Python, Elixir, Rust and .NET implementations.
• 6.5.0 (October 26): the only listed change enforces the node: protocol for built-in imports. Check custom bundler or resolver configs.

Motion 14.8.0 and 14.9.0

Per the changelog, 14.9.0 (October 30) improves Reorder keyboard accessibility: focus lands on the first item, arrow keys move focus, and direction follows the on-screen layout. 14.8.0 (October 29) adds a mixer option on transitions, fixes accelerated animations stuck at initial after remount, and shrinks drag by 20% and the m component by 6%.

import { Reorder } from "motion/react"

export function List({ items, setItems }) {
  return (
    <Reorder.Group axis="y" values={items} onReorder={setItems}>
      {items.map(item => (
        <Reorder.Item key={item} value={item}>{item}</Reorder.Item>
      ))}
    </Reorder.Group>
  )
}
// 14.9.0: no code change needed, keyboard navigation is built in

Prisma and Drizzle Pre-Releases

Stay on Prisma 7.10.1 for production. Prisma 8.0.0-rc.20 requires @prisma/cli-engine 0.9.0 and needs --json for scripts reading piped output; rc.19 changed @default to mean a database default (use @onCreate/@onUpdate for client values). npm has since moved on to rc.29, without release notes I could find.

Drizzle 1.0.0-rc.5 throws on undefined in relational where filters (use EmptyFilter) and routes all withReplicas queries to primary unless you use db.$replica.

Smaller Releases

• Astro 7.4.4 (October 28): astro add can now configure tagged versions of official adapters. Astro's tooling requires Node 22.23.4 or later.
• Svelte 5.57.3 (October 26): fixes a11y role fallback, derived dependency tracking and redundant attribute writes during hydration.
• Vue 3.6.0-rc.14 (October 30): the release page does not list changes and points to the minor branch CHANGELOG. Stable remains 3.5.44.

npm also shows Firebase 13.2.0 pre-release and Node 24.22.2 builds, but I could not find release notes for them, so they are not analyzed here.

Action Checklist

1. Confirm every Node.js runtime and container image is on 26.12.1, 24.22.1 or 22.23.4 or later, and rebuild on a fresh base pull.
2. Check the Next.js security release that was scheduled for November 3 against your lockfile. Confirm Next.js is at 16.4.1+ on the 16.x line or 15.5.28 on the 15.x line, and move 15 apps to 16.x because Next.js 15 maintenance ended October 21.
3. Upgrade Nuxt to 4.6.3 and rebuild.
4. Patch PgBouncer to 1.26.1 and schedule PostgreSQL 14 upgrades before November 12.
5. Test registry TLS after upgrading to Docker 29.9.2.
6. Move Keycloak 26.7.x or older deployments to 26.8.1.
7. Upgrade SvelteKit to 3.1.1.
8. Move Wrangler to 4.156.0, audit anything autoconfig uploaded from a project root, and check secrets files for literal $.
9. Make sure every Better Auth client ID is configured.
10. Plan Kubernetes patch upgrades for your minor line.

Version details come from the linked release pages. Confirm against them before pinning.

Sources

• Node.js October 2026 security releases
• Node.js v26.13.0 release
• Next.js security release advance notice, November 2026
• Next.js security update, October 14
• Next.js upcoming security update, October 2026
• Next.js v15.5.28 release
• Next.js v16.4.3 release
• Next.js v16.5.0-canary.30
• Next.js 16.4 announcement
• Nuxt v4.6.3 release
• PostgreSQL news archive
• Moby releases
• Docker Engine lifecycle table
• Keycloak releases
• SvelteKit 3.1.1 release
• Wrangler 4.156.0 release
• Wrangler 4.155.0 release
• Wrangler 4.153.0 release
• NestJS releases
• Better Auth releases
• Kubernetes v1.37.2 release
• Kubernetes v1.37 changelog
• Releasebot React updates
• Hono releases
• BullMQ v6.5.3 release
• Motion changelog
• Prisma releases
• Drizzle ORM releases
• Astro 7.4.4 release
• Svelte 5.57.3 release
• Vue v3.6.0-rc.14