Dev Stack Release Audit, October 5-11, 2026: Next.js 16.3.8 Security Fixes and Keycloak 26.7.5

Executive Summary

• Next.js 16.3.8 and 15.5.27 (security): seven advisories, including a high-severity image optimization SSRF (CVE-2026-94483). A second, out-of-band update with two Critical and one High fixes is scheduled for October 14.
• Keycloak 26.7.5 (security): 13 CVEs fixed, including a CIBA lockout bypass (CVE-2026-16103) and SAML redirect parameter pollution (CVE-2026-18217). Keycloak 26.8.0 follows with SCIM and multi-cluster v2 as supported features.
• Node.js 22.23.3 LTS: patches an HTTP/2 use-after-free and updates OpenSSL to 3.5.8. Node.js 26.10.0 adds util.throttle() and util.debounce(), and 26.11.1 is the newest Current build.
• Astro 7.3.6 and 7.3.7: CSRF hardening, Host header validation for the Node adapter and a fix for security.checkOrigin.
• SvelteKit 3.0 and Firebase JS SDK 13.0.0: both are breaking majors. SvelteKit 3.0.1 is the first patch.
• Nuxt 4.6.0: new CLI v4, nuxt/server imports, cookie-sealed sessions and a Nuxt 5 preview flag. 4.6.1 followed on October 9.
• Docker Compose 5.6.0: partial support for manually triggered jobs.

Next.js: Patch Now, Then Plan for October 14

16.3.8 and 15.5.27: seven security fixes

Vercel's September 2026 security release (September 30) is the one to act on if you self-host. The fixes are in 16.3.8 (Active LTS) and 15.5.27 (Maintenance LTS):

• High: SSRF during Image Optimization when images.remotePatterns allows an attacker-influenced remote URL (CVE-2026-94483, GHSA-cjq9-62q9-8jv4). Apps without remotePatterns are not affected.
• Medium: SSG/ISR cache poisoning on self-hosted Pages Router apps (CVE-2026-94543) and with root-level catch-all pages (CVE-2026-94484).
• Medium: metadata image routes ignoring dynamicParams on webpack builds (CVE-2026-94485); Turbopack builds are not affected.
• Medium: use cache issues with Cache Components: a root-param cache leak (GHSA-h694-7cp9-m8p3) and Draft Mode content leaking into regular responses (CVE-2026-94544).
• Low: the next dev Model Context Protocol endpoint did not check request origin (CVE-2026-94486). Production is not affected.

Next.js 16.3.6 and 15.5.26 earlier addressed a critical ImageResponse remote code execution issue (GHSA-vcvr-r3jv-pc5j).

npm install [email protected]   # 16.x line
npm install [email protected]  # 15.x line

The October 14 out-of-band update

Vercel's Next.js team says the update addresses three upstream-dependency vulnerabilities (two Critical, one High), two of which were postponed from the September security release due to upstream coordination. Full advisories, affected versions and upgrade instructions will be published with the release. Until then, pin your current version and be ready to upgrade.

# Check what you run today
npm ls next

# After the Oct 14 release, upgrade to the patched line
npm install next@latest

Next.js 16.4.0 (October 6) is the current stable release, with 16.5.0 canary builds in progress. Its release notes were not reviewed in this window. React is at 19.3.0 (September 9).

Keycloak 26.7.5 and 26.8.0

26.7.5 security fixes

The September 30 patch release fixes 13 vulnerabilities. Several affect common configurations, so treat it as a priority patch if you are still on 26.7.x:

• CVE-2026-16103: CIBA brute-force lockout bypass at token redemption (an incomplete fix for CVE-2026-9798).
• CVE-2026-18206 and CVE-2026-18211: client policy and secure-client-uris host matching accepted non-subdomain suffixes and localhost-prefixed attacker domains.
• CVE-2026-18217: SAML Redirect Binding parameter pollution.
• CVE-2026-89298: confidential client secret disclosed to the view-clients role through Client Registration GET.
• CVE-2026-88770: Device Authorization Grant issued tokens to brute-force-locked accounts.
• CVE-2026-93999: token-exchange refresh kept issuing tokens for a disabled audience client.

The release also bumps dependencies with their own CVEs (BouncyCastle, FreeMarker, owasp-java-html-sanitizer). The full list is in the 26.7.5 release notes. Keycloak 26.7.4 (September 16) fixed six more issues, so skipping straight to 26.7.5 or 26.8.0 covers both.

26.8.0

Keycloak 26.8.0 shipped on October 1. The headline items are the SCIM API and multi-cluster v2 reaching supported status, Client Secret Rotation for zero-downtime rotation, shared identity providers across organizations, and OID4VCI (digital wallet credential issuance) promoted to preview. Token exchange delegation now supports consent and Fine-Grained Admin Permissions.

Plan for these breaking changes before upgrading:

• The multi-site feature (multi-cluster v1) is deprecated. Migrate to the stateless feature for v2.
• Login failure data is now stored in the database instead of memory. Expect extra write load on busy realms.
• New organization IdP links default to the "Unmanaged" membership type, and existing links are migrated to "Managed".
• The identity provider button section of the login theme was redesigned. Custom themes need updates.
• Legacy OIDC compatibility modes, the "Full scope allowed" client switch and non-OIDC client registration providers are deprecated.

Read the upgrading guide before rolling out. If you run a custom theme, test the login page in staging first.

Node.js: 22.23.3 LTS, 26.10.0 and 26.11.1

Node.js 22.23.3 'Jod' (September 23) patches an HTTP/2 use-after-free, bumps OpenSSL to 3.5.8, Undici to 6.28.1 and npm to 10.9.9, and refreshes root certificates to NSS 3.125. It also adds SharedArrayBuffer support to Node-API, per the release list. In containers, rebuild images so the base layer picks up the patch:

FROM node:22.23.3-slim
# or: docker pull node:22-slim && docker build --no-cache .

Node.js 26.10.0 (Current, September 22) adds several utilities. util.throttle() and util.debounce() remove a common reason to pull in a helper package, crypto.parsePKCS12() parses PKCS#12 bundles, fs.openAsBlobSync() opens files as Blob objects synchronously, and util.markPromiseAsHandled is new. SQLite now binds undefined to NULL, and Hybrid KEMs were added to the Web Cryptography API.

import { debounce } from 'node:util';

const save = debounce(() => console.log('saved'), 250);
save(); save(); save(); // logs once, 250 ms after the last call

The signature above follows the release notes' description of util.debounce(). Verify argument order against the 26.10.0 notes before depending on it. These APIs are on the Current line, so production services on LTS will not see them yet.

Node.js v26.11.1 and v26.11.0 were both cut on October 7 (see the distribution index and v26.11.1); neither is flagged as a security release or LTS. Node.js 24.21.0 LTS shipped on September 9.

Astro 7.3.6, 7.3.7 and 7.3.8

The Astro changelog does not label entries as security fixes, but several are security relevant:

• 7.3.7: security.checkOrigin no longer rejects cross-origin requests with non-form content types such as application/json. It now applies only to unsafe requests with no content type or a form-style one.
• 7.3.6: CSRF protection now accounts for modern browser headers, the Node adapter validates the Host header against security.allowedDomains, and composable astro/fetch and astro/hono handlers reject over-encoded request paths with 400.

If you deploy the Node adapter, set the allowed domains explicitly:

// astro.config.mjs
export default defineConfig({
  security: { allowedDomains: [{ hostname: 'example.com' }] },
})

Astro 7.3.8 (October 8) is the current latest tag.

SvelteKit 3.0 and 3.0.1

SvelteKit 3.0.0 shipped on October 1 alongside the sv 1.0 CLI, per the announcement. Project configuration now lives in vite.config.ts instead of svelte.config.js, and the $lib alias is replaced by the standard subpath import #lib, so module imports need explicit extensions. Version 3.0.1 (October 6) only fixes generated types so relative imports work with nodenext module resolution.

Breaking changes to audit before upgrading, from the announcement and the changelog:

• Minimum versions: TypeScript 6, Node 22.17, Vite 8.0.12, Svelte 5.56.4 and @sveltejs/vite-plugin-svelte v7.
• Removed: $app/stores, the $service-worker module, the preloadStrategy option, @sveltejs/kit/node/polyfills, handleValidationError (validation errors now reach handleError with kind: 'validation') and the CSRF checkOrigin option. base, assets and resolveRoute are gone from $app/paths.
• Types moved: remote function types to $app/server, env types to @sveltejs/kit/env, hook types to @sveltejs/kit/hooks, navigation types to $app/navigation and form types to $app/forms.
• Security defaults: external redirects are forbidden by default, cross-origin form submissions without a Content-Type header are rejected, and query parameters starting with x-sveltekit- are rejected.
• Behavior: goto now rejects unresolvable URLs, clicking a link to the current URL reloads all load functions, cross-page form actions navigate like native forms, cookie path defaults to /, cookie names must be ASCII, and version polling defaults to one hour.

New additions include the $app/manifest module, a kit.paths.origin option, production sourcemaps and the QUERY HTTP method in +server.js. The team provides an automated migration that rewrites what it can and leaves a TODO list for the rest:

npx sv migrate sveltekit-3 --tasks all --confirm
# then verify the toolchain
node --version   # >= 22.17
npm ls vite svelte @sveltejs/vite-plugin-svelte

Replace store usage with the rune-based equivalents from $app/state. Remote functions are still behind experimental flags, per the announcement.

Firebase JS SDK 13

Firebase 13.0.0 (October 7) is a breaking release for anyone using AI Logic. Per the release notes:

• VertexAIBackend and BackendType.VERTEX_AI are removed. Use AgentPlatformBackend, whose default location is now global.
• TemplateGenerativeModel.generateContent takes a single TemplateRequest, and templateVariables is now required.
• Part is a discriminated union with explicit type properties, and a new UnknownPart covers raw input.
• Firestore gains BSON type support, and Auth keeps the persisted user when the initial reload fails with a quota or rate-limit error.

To keep the previous region, pin it explicitly:

import { getAI, AgentPlatformBackend } from 'firebase/ai'

const ai = getAI(app, { backend: new AgentPlatformBackend('us-central1') })

Nuxt 4.6

Nuxt 4.6.0 (October 5) requires Node ^22.22.3 || ^24.15.0 || >=26.0.0. The headline is the rebuilt tooling: Nuxt CLI v4 adds an interactive nuxt dev terminal UI, a lock file in .nuxt/, and new nuxt curl, nuxt task and nuxt docs commands. nuxt init is gone, so use npm create nuxt@latest for new projects.

• nuxt/server imports: server code can use web-standard request primitives that should run across Nitro v2, Nitro v3 and the experimental @nuxt/vite-server. Helpers differ from h3 v1: createError takes status and statusText, and headers are set through event.res.headers. Do not mix auto-imported h3 helpers with nuxt/server helpers on Nuxt 4, because that raises NUXT_E8012.
• Sessions: a root NUXT_APP_SECRET setting enables cookie-sealed session helpers such as useSession.
• Typed $fetch: rebuilt on fetchdts to avoid TypeScript instantiation limits on large route sets. Opt in with experimental.routeTypedFetch.
• Vue Vapor: interop mode is enabled per component with the vapor attribute.
• Security hardening: the internal error route is only served to error renders, dev error reports are scoped for remote peers, and unhandled error data is no longer passed to the error page.

Opt in to the Nuxt 5 defaults and the experimental Vite server builder like this:

// nuxt.config.ts
export default defineNuxtConfig({
  future: { compatibilityVersion: 5 },
  experimental: { routeTypedFetch: true },
  server: { builder: 'vite' }, // experimental, Nitro stays the default
})

Upgrade with npx nuxt upgrade --dedupe. Nuxt 2 and @nuxt/bridge are no longer supported, and Nuxt 3 has reached end of life. Nuxt 4.6.1 shipped on October 9.

Docker Compose 5.6.0

Compose 5.6.0 (October 2) adds partial support for jobs: only manually triggered jobs work for now, and scheduled jobs are not available yet. It also improves provider services (network relay), build progress handling, watch rebuild coalescing, port publisher stability on dual-stack hosts, and dangling image cleanup during down.

Check the release notes for the exact spec syntax before using jobs. As a rough shape, a job is a service that you run on demand rather than keep alive:

# compose.yaml (illustrative; confirm syntax in the 5.6.0 release notes)
services:
  web:
    image: myapp:latest
jobs:
  migrate:
    image: myapp:latest
    command: ["npm", "run", "migrate"]

Try it in a dev environment, and keep production on a pinned Compose version until the feature matures.

Motion 14

Motion 14.0.0 was published to npm on October 2, pinning framer-motion 14.0.0 and keeping React 18 and 19 as peer dependencies, and Motion 14.1.0 followed on October 9. The Motion changelog had not listed 14.0.0 when checked, so review the notes before upgrading. The preceding 13.5.0 added negative bounce values for overdamped springs, shrank the <m> component by 20% and useSpring by 10%, and moved scroll/useScroll offset animations to the main thread.

import { spring } from 'motion'

// 13.5.0+: negative bounce (0 to -1) gives an overdamped spring
const type = spring({ stiffness: 300, bounce: -0.4 })

Prisma 8 Release Candidates

Prisma tagged 8.0.0-rc.22 on October 8, so a major is close. The project's releases page notes breaking changes across the series, so avoid auto-upgrading to the latest tag in CI and test on a branch rather than production.

# Try the Prisma release candidate in isolation
npm install prisma@rc @prisma/client@rc --save-dev

Other Latest Tags

These come from registry metadata, and their release notes were not reviewed, so check the linked pages before upgrading:

• Frameworks: Svelte 5.57.2 (October 6), Vue 3.5.43 (September 17).
• Backend: NestJS core 12.1.2, Fastify 5.12.5, Express 5.3.0 (October 9), Hono 4.13.13 and Elysia 1.4.30.
• UI: MUI 9.5.0 (October 9) and Tailwind CSS 4.3.3, the latest since July 16.
• Data: Drizzle ORM 0.45.4 (October 8), MongoDB Node driver 7.7.0 (September 28) and supabase-js 2.117.3 (October 7).
• Identity and queues: Better Auth 1.7.7 (September 30), Clerk Next.js SDK 7.9.14 and Auth0 Node SDK 7.4.0 (October 9), and BullMQ 6.3.12 (October 9).

Action Checklist

1. Move Next.js to 16.3.8 or 15.5.27, review images.remotePatterns, and schedule an upgrade window for October 14.
2. Upgrade Keycloak to 26.7.5 at minimum, or to 26.8.0 after reviewing the breaking changes.
3. Rebuild Node 22 images on 22.23.3 to pick up the HTTP/2 fix.
4. Check Astro security.allowedDomains if you deploy the Node adapter.
5. Plan SvelteKit 3 on a branch: run npx sv migrate sveltekit-3, then fix store and type imports.
6. Review Firebase 13 release notes before upgrading, and migrate off VertexAIBackend.
7. Read the Motion 14 notes before bumping from 13.x, and trial the Prisma 8 RC on a branch.

Coverage varied by day in this window. Docker Engine, Kubernetes, PostgreSQL, Redis, Django and Laravel could not be verified, so no claims are made about them.

Sources

• Next.js September 2026 security release
• Next.js upcoming security update, October 2026
• Keycloak 26.7.5 release
• Keycloak 26.8.0 release
• Keycloak upgrading guide
• Node.js releases on GitHub
• Node.js v26.10.0 notes
• Node.js v22.23.3 notes
• Node.js distribution index
• Astro changelog
• SvelteKit 3 announcement
• SvelteKit changelog
• Firebase JS SDK releases
• Nuxt v4.6.0 release
• Docker Compose releases
• Motion changelog
• Prisma releases