Dev Stack Release Audit, October 1-4, 2026: Better Auth 1.7.7 Magic Link Fix and Next.js 16.3.8 SSRF Patch

Executive Summary

• Better Auth 1.7.7 (critical): fixes a Magic Link account takeover (GHSA-965c-763c-88jm), an OAuth Proxy state-validation flaw and a disableSignUp bypass on ID-token sign-in.
• Next.js 16.3.8 and 15.5.27 (high): close a high-severity SSRF in Image Optimization (GHSA-cjq9-62q9-8jv4) plus five medium and one low advisory. They sit on top of the critical ImageResponse RCE fixed in 16.3.6.
• Keycloak 26.7.4: closes six CVEs, including an impersonation-to-realm-admin escalation (CVE-2026-17526) and an unauthenticated denial of service (CVE-2026-79651). Keycloak 26.7.5 (September 30) is the newer release and is covered in next week's audit.
• PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24: the latest security release lists several CVSS 8.8 issues in pg_dump, psql and the core server.
• GitHub CLI 2.102.0: patches four advisories, including symlink-following writes and attestation verification bypasses.
• Hono 4.13.11 and 4.13.13: a serveStatic middleware bypass (GHSA-5r4p-p66f-jhc7) is fixed, and hono/mount replaces app.mount().
• SvelteKit 3.0.0 (October 1): a major release with Node 22.17+, TypeScript 6+, Vite 8 and the $lib to #lib change.

Better Auth 1.7.7: Magic Link Account Takeover

The v1.7.7 release (September 30) resolves a critical Magic Link account-takeover vulnerability tracked as GHSA-965c-763c-88jm. No database migration is needed, but deployments where several servers share verification storage must upgrade all of them together.

The same release fixes the OAuth Proxy, which wrongly accepted sign-in state as a provider profile, and enforces a social provider's disableSignUp setting during ID-token sign-in. Rate-limit and CAPTCHA errors now return a JSON Content-Type, and PostgreSQL concurrent rate-limiting and the Kysely adapter's consumeOne were corrected.

npm install [email protected]
# multi-server setups: upgrade every node, then
# request fresh magic links and restart pending OAuth/SAML sign-ins

If you use the OAuth Proxy, follow the upgrading existing deployments guide, since all participants must move to the new version at the same time.

Next.js: Two Security Releases in Eight Days

16.3.8 and 15.5.27: SSRF and cache fixes

The v16.3.8 release (September 30) is a security-focused release, described in the September 2026 security release post:

• High: GHSA-cjq9-62q9-8jv4, SSRF in Image Optimization.
• Medium: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p, cache poisoning of SSG/ISR pages in self-hosted deployments, including cross-user content substitution and persistent denial of service.
• Medium: GHSA-f87g-xv8r-7p7x, information disclosure in App Router metadata image routes via a dynamicParams bypass.
• Medium: GHSA-3w37-wq28-93x7 (Draft Mode content leaking through a pending use cache fill) and GHSA-h694-7cp9-m8p3 (cache leak across root param values in nested use cache).
• Low: GHSA-39w2-rjm5-chcv, information disclosure in the dev server's Model Context Protocol endpoint.

The v15.5.27 release backports the metadata-route and both cache-poisoning fixes for the 15.x line. Teams still on 16.3.6 or 15.5.26 should upgrade again.

npm install [email protected] react@latest react-dom@latest
# 15.x line
npm install [email protected]

Until you upgrade, restrict image optimization to known hosts:

// next.config.js
module.exports = {
  images: {
    remotePatterns: [{ protocol: 'https', hostname: 'cdn.example.com' }],
  },
}

16.3.6 and 15.5.26: critical ImageResponse RCE

The Next.js security update from September 22 describes improper escaping in SVG output generated by Satori that, combined with flaws in other upstream dependencies, could lead to remote code execution in the Node.js ImageResponse implementation (next/og). See advisory GHSA-vcvr-r3jv-pc5j and the upstream Satori advisory.

Affected: >=16.2.0 <16.3.6. The Edge ImageResponse implementation is not affected. Next.js 15.x is not affected by the RCE; 15.5.26 only adds hardening. Moving to 16.3.8 or 15.5.27 covers this as well.

Keycloak 26.7.4: Six CVEs

The Keycloak 26.7.4 announcement (September 16) lists:

• CVE-2026-17526: the impersonation role can escalate to realm administrator.
• CVE-2026-79651: unauthenticated denial of service via unbounded locale caching.
• CVE-2026-19607: username takeover that locks out the victim.
• CVE-2026-74909: a percent-encoded semicolon bypasses matrix parameter stripping.
• CVE-2026-90997: default MySQL/MariaDB row counts let stateless replay gates accept reused artifacts.
• CVE-2026-18212: the SAML redirect DEFLATE helper leaks native zlib state.

The release also moves to Quarkus 3.33.3.2 and fixes a performance regression from 26.6.2. Keycloak 26.7.5 (September 30) is the newer release, so target that instead; it is covered in next week's audit. Review the migration guide before upgrading, and audit who holds the impersonation role.

docker pull quay.io/keycloak/keycloak:26.7.5

PostgreSQL: Security Release Across All Supported Branches

The PostgreSQL security page lists fixes in 18.6, 17.11, 16.15, 15.19 and 14.24. Several issues score CVSS 8.8, including CVE-2026-19385 (pg_dump heap buffer overflow), CVE-2026-18408 (psql \unrestrict), CVE-2026-16239 (type confusion around cursor CLOSE and DECLARE) and CVE-2026-14664 (regexp heap buffer overflow). Check each CVE's affected-versions table, then update the server and client tools together, since pg_dump and psql are affected.

psql -c "SELECT version();"

GitHub CLI 2.102.0: Four Security Fixes

The v2.102.0 release (September 30) fixes:

• GHSA-39wj-f2f4-978v: symlink-following writes in download commands.
• GHSA-4mq3-hpgx-9cx8: case-insensitive --source-ref matching in gh attestation verify.
• GHSA-qcwj-mr2r-2cx7: option injection in gh skill search.
• GHSA-wjmr-j3rp-mh2g: prefix-only --signer-workflow matching.

If you rely on attestation verification in CI, update developer machines and CI images now.

Hono: serveStatic Bypass and the New mount Middleware

Hono 4.13.11 (September 29) fixed GHSA-5r4p-p66f-jhc7: serveStatic decoded the request path a second time, so a crafted request could route as one path and serve another, bypassing middleware guarding static paths. Affected packages include hono/serve-static, hono/bun, hono/deno, hono/cloudflare-workers and the matching @hono/* adapters. The release notes do not state a severity. The fix rejects paths that still contain % after decoding; to serve files with a literal percent sign in the name, opt in with allowPercentInPath: true.

Hono 4.13.13 introduces hono/mount as a handler-based replacement for app.mount(), which stays functional in v4 but is marked for removal in v5. Migration is one line:

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
// before: app.mount('/itty-router', ittyRouter.handle)
app.all('/itty-router/*', mount(ittyRouter.handle))

SvelteKit 3.0: Breaking Changes to Plan For

The SvelteKit 3.0.0 release (October 1) requires Node 22.17+, TypeScript 6+, Vite 8.0.12+ and Svelte 5.56.4+. Notable changes: the $app/stores module is removed in favor of $app/state, $lib becomes the standard subpath import #lib, cookies move to v2 (ASCII-only names), fail() status codes are now used in form action responses, and all load functions refresh when navigating to the current URL. Release trackers such as Releasebot also list the config moving toward vite.config.ts.

// before
import { page } from '$app/stores';
import { helper } from '$lib/helper.js';

// after (SvelteKit 3)
import { page } from '$app/state';
import { helper } from '#lib/helper.js'; // explicit extension required

Node.js: Current and LTS Builds

The Node.js release blog shows v26.10.0 (September 22), v24.21.0 (September 9) and v22.23.3 (September 23). Node.js 26 is scheduled to enter LTS in October, after which the project moves to one major release a year. Plan production pinning accordingly.

GitHub Platform and npm Supply Chain

Per the GitHub release feed:

• npm trusted publishing now has opt-in, disabled-by-default dist-tag permissions for OIDC workflows (September 30).
• Private vulnerability reports get daily per-user rate limits and a structured form customizable via .github/VULNERABILITY_REPORT.yml (October 1).
• macOS 14 runners retire November 2, with brownouts October 5-31.
• Actions Runner Controller 0.15.0 shipped.

NestJS, BullMQ and Prisma

• NestJS: v12.1.1 fixes logger bugs in JSON output, level changes, fatal and buffered logs, hardens microservices (MQTT client retry logic, preserved TCP event listeners) and improves circular-dependency detection and provider overrides. v12.1.2 and v11.2.7 followed on September 30 as maintenance releases with minimal notes.
• BullMQ 6.3.11: the release detaches the stalled-job checker from the telemetry context, preventing a trace leak in workers that run with OpenTelemetry. The Python port also gained getJob in vpy3.3.0.
• Prisma 8 release candidates: recent dev builds such as v8.0.0-rc.14-dev.20 add hover declarations and /// doc comments for models, composite types, fields and attributes in .prisma files. These are pre-releases, so keep them out of production.

Registry Snapshot

Latest npm versions on October 4: Next.js 16.3.8, React 19.3.0, Astro 7.3.5, Svelte 5.57.1, Fastify 5.12.5, Vite 8.3.2, Drizzle ORM 0.45.3, Hono 4.13.13, Better Auth 1.7.7 and BullMQ 6.3.11, per the npm registry. Not every tool on the watch list published a verifiable release in this window, so only confirmed items are covered.

Action Checklist

1. Upgrade Better Auth to 1.7.7 on every node that shares verification storage.
2. Upgrade Next.js to 16.3.8 or 15.5.27 and review self-hosted ISR/SSG caching.
3. Upgrade Keycloak to 26.7.5, the newer release covered in next week's audit, and review impersonation permissions.
4. Apply the PostgreSQL minor updates to servers and client tooling.
5. Update gh to 2.102.0 on developer machines and CI images.
6. Upgrade Hono to 4.13.11 or later wherever serveStatic guards content with middleware, and plan the app.mount() to mount() migration before Hono v5.
7. Audit SvelteKit projects for $app/stores and $lib usage before migrating to 3.0.
8. Move off macos-14 runners before the November 2 retirement.
9. Plan the Node.js 26 LTS transition.

Sources

• Better Auth v1.7.7 release
• Better Auth OAuth Proxy upgrade guide
• Next.js September 2026 security release
• Next.js security update, September 22
• Next.js v16.3.8 release
• Next.js v15.5.27 release
• Keycloak 26.7.4 announcement
• PostgreSQL security page
• GitHub CLI v2.102.0 release
• Hono 4.13.11 release
• Hono 4.13.13 release
• SvelteKit 3.0.0 release
• Releasebot Svelte updates
• Node.js release blog
• GitHub release feed
• BullMQ 6.3.11 release
• Prisma v8.0.0-rc.14-dev.20
• npm registry