Dev Stack Release Radar — August 31, 2026: Critical Patches for Next.js, Keycloak, Redis & More

Executive Summary

Six coordinated security releases landed across the stack this week, several of them critical. The headline items:

• Next.js 16.3.3 / 15.5.24 patches two critical, pre-auth RCEs: a crafted-AVIF exploit in Image Optimization (GHSA-2xp9-vwfh-vxw4) and a Windows-only path-traversal RCE affecting apps mixing Pages and App Router without Cache Components (GHSA-p293-qw3h-jr36).
• Keycloak 26.7.2 closes an unauthenticated account-takeover bug in the reset-credentials flow (CVE-2026-18963, CVSS 9.1) that let attackers skip the emailed action-token step entirely, plus a predictable account-linking hash flaw (CVE-2026-15571).
• Redis 8.10.1 and back-ported point releases fix a CMSketch RDB-loading buffer miscalculation, a malicious RDB SLOT_INFO id leading to memory corruption, a TLS use-after-free, and two Vector Sets bugs.
• Node.js 26.5.1 / 24.18.1 / 22.23.2 fix 11 CVEs, three HIGH severity, including an HTTP/2 memory-exhaustion bypass and a Permission Model prefix-boundary escape.
• Django 6.0.8 and 5.2.17 fix four CVEs including a High-severity GDALRaster flaw enabling arbitrary file writes or SSRF for any staff user with view permission on a spatial-field model.
• Docker Desktop 4.76.0 fixes CVE-2026-8936, a grpcfuse kernel-module DoS from unbounded recursion on nested bind-mount directories.
• Also shipping this cycle: Hono 4.13.5 (3 advisories fixed), Fastify 5.12.1 (2 advisories), Podman 6.1.0 (2 CVEs), and coordinated PostgreSQL point releases addressing 28 vulnerabilities.
• Feature-side highlights: Kubernetes v1.37, NestJS v12 (ESM-ready core, Rspack default bundler), Authentik 2026.8.0 achieving official OpenID certification, and a moved-up Cloudflare Workers Access overhaul.

Critical Security Patches: What to Upgrade Today

Next.js: crafted-AVIF RCE and a Windows path-traversal bug

Vercel moved up its scheduled security release after finding a second critical issue, shipping both fixes together in [email protected] and [email protected] on August 25, 2026. The first, GHSA-2xp9-vwfh-vxw4, is an unauthenticated RCE rooted in the upstream libheif library used by sharp for AVIF decoding during Image Optimization; the patch disables AVIF optimization until libheif ships its own fix. The second, referenced as CVE-2026-75604 / GHSA-p293-qw3h-jr36, is a Windows-only RCE affecting deployments that mix Pages Router and App Router without Cache Components (Linux and macOS hosts are unaffected). Vercel-hosted apps were patched automatically; everyone self-hosting needs to update immediately.

npm install [email protected]   # Pages/App Router on 15.x
npm install [email protected]   # 16.x line

Keycloak: unauthenticated account takeover via password reset

The most severe IAM finding this week: CVE-2026-18963 (CVSS 9.1) let an attacker skip straight to the password-update step of the reset-credentials flow without ever presenting the emailed action token — a state-validation gap that could compromise any account, including admins. Upstream fixed it in Keycloak 26.7.2 on August 19; Red Hat build of Keycloak users should apply 26.4.15 or 26.6.6. The same release also closes CVE-2026-15571, a predictable account-linking hash that enabled takeover through a malicious OIDC client. No exploitation was observed at disclosure, but given the severity this should be treated as a same-day patch.

Redis, Node.js, and Django round out the critical list

• Redis 8.10.1 and matching point releases (6.2.24 through 8.8.2) fix a CMSketch RDB buffer-size miscalculation, a crafted RDB SLOT_INFO id causing memory corruption, a TLS pending-data use-after-free, and two Vector Sets bugs (missing RDB validation, a VREM/VSIM race). Any self-managed Redis taking untrusted RDB files or exposing TLS listeners should patch now.
• Node.js's July 2026 security release (26.5.1 / 24.18.1 / 22.23.2) fixes 11 CVEs — three HIGH: an HTTP/2 header-retention bypass of maxSessionMemory, a re-entrant HTTP/2 send causing heap-use-after-free, and a Permission Model radix-tree prefix escape that over-grants filesystem access.
• Django's August 4 releases (6.0.8, 5.2.17) fix a High-severity GDALRaster flaw where spatial lookups could pass dict/string values through to trigger arbitrary file writes or SSRF, plus a moderate admin XSS via unsafe URLField schemes.

Containers, Edge & Infrastructure

Docker's own release this cycle was compute/perf-focused beyond the CVE fix: Docker Compose v5.5.0 overhauled image-digest reconciliation to stop unnecessary container recreation, following v5.4.0's volume/network lifecycle rework. On the platform side, Kubernetes v1.37 (Aug 26) adds pod-eviction coordination and alpha support for binding service-account tokens to webhook configurations, while Podman 6.1.0 adds `podman volume rename` and `podman machine restart` alongside its two CVE fixes.

Cloudflare shipped several Workers-platform changes worth flagging: Access can now be enabled per-Worker or account-wide, with policy attached to the Worker itself so every route, custom domain, and preview URL stays covered without manual sync — including a private-by-default option. Separately, Workers AI and AI Gateway are now unified behind one binding/REST surface, and Durable Objects now support 10 concurrent Dynamic Workers, up from 4.

On hosting: Render moved to spec-based compute plan IDs (e.g. `4c-32g`) and cut median build times roughly 40% by moving builds to faster nodes. Railway is phasing out Config-as-Code in favor of a new Infrastructure-as-Code SDK and shipped Access Groups plus template rollback. On AWS, EC2 gained a new application-level status check and a new IAM Role Manager that auto-provisions the roles AWS services need.

Identity & Authentication

Beyond the Keycloak CVE above, the identity space had one major milestone: authentik 2026.8.0 is now officially OpenID Certified by the OpenID Foundation across the Basic, Implicit, Hybrid, Config, and Form Post OP profiles. The same release adds Privileged Access Management with approver workflows, delegated "Agent Accounts" for service-to-service auth, OAuth2/OIDC token exchange, Dynamic Client Registration, and a Rust rewrite of the server entrypoint and proxy outpost for performance.

On the commercial side, Clerk added Admin Logs for Business/Enterprise plans — an audit trail of admin actions — while Auth0's Flexible Password Policy reached GA with a 15-character default minimum for new connections, aligned with NIST guidance. Structurally, it's worth noting Auth.js (NextAuth.js) is now maintained by the Better Auth team, which shipped v1.7.2 (native DB transactions for test instances) and v1.7.1 (SCIM boolean-field parsing fixes improving Microsoft Entra interop) this month.

Meta-Frameworks & Core Web Standards

Outside the security release, Next.js 16.3 (Aug 3) cut dev-server RAM usage up to 90% via Turbopack disk caching, made `next build` up to 5.5x faster on repeat builds, and added native Node.js streams for SSR (+22% throughput under load). Vue 3.5.42 is a hydration/Suspense bug-fix release, while Vue 3.6.0-rc.6 continues the Vapor Mode release-candidate cycle aimed at Solid/Svelte-5-competitive bundle sizes.

In the Svelte ecosystem, SvelteKit 3 preview builds (`3.0.0-next.25`) added `$app/manifest` and `$app/service-worker` modules and Vite 8 support, while stable `@sveltejs/kit` sits at 2.70.3. Svelte 5.57.0 continues an active weekly patch cadence. Astro 7.2 (patched through 7.2.9) adds experimental incremental static builds that skip regenerating unchanged prerendered pages, plus a `session: false` opt-out to shrink bundles.

Backend Frameworks & Runtimes

The biggest backend move this cycle is NestJS v12 (Aug 27): ESM-ready core packages, first-class Standard Schema validation, a rebuilt CLI, and a new `@nestjs/observe` SDK for request-lifecycle observability. Rspack is now the default bundler for monorepos and Vitest the default test runner for ESM projects; it requires Node.js 20.19+ or 22.12+.

Edge-runtime frameworks both shipped security releases: Hono 4.13.5 fixes a query-parser cache-poisoning vector, an incomplete path-normalization bypass in `toSSG()`, and unbounded dot-notation nesting in `parseBody({ dot: true })` that could exhaust heap memory. Fastify 5.12.1 backports fixes for two GitHub security advisories alongside a `preClose` hook double-invocation fix.

// Hono 4.13.0+ QUERY method support
app.on('QUERY', '/search', (c) => {
  return c.json({ results: [] })
})

On the Python/PHP side: FastAPI has nothing newer than v0.141.1 (Jul 29) — no August release found. Laravel Framework v13.29.0 is the latest tag (Aug 25), and Laravel Cloud now detects missing or outdated packages before deployment.

UI Systems, Styling & Motion

shadcn/ui shipped a new Questionnaire component for multi-step flows (onboarding, intake forms, agent clarification prompts) available across Base UI, React Aria, and Radix styling, plus a headless primitive in `@shadcn/react`. A companion `@shadcn/helpers` release added human-in-the-loop mocking for the AI SDK, pausing tool calls behind approval gates. Radix UI itself has nothing newer than its July 24 stable release. Tailwind CSS is likewise quiet since v4.3.3 (Jul 16), though a `@tailwindcss/turbopack` package is queued in the unreleased changelog.

MUI's v9.4.0 release focuses on accessibility: a new `theme.focusVisible` option for consistent keyboard focus rings and improved Tooltip support for disabled trigger buttons without a wrapper element. Motion (Framer Motion) v13 dropped the optional `@emotion/is-prop-valid` dependency in favor of explicit `MotionConfig` prop validation, and v13.1.0 added multidimensional reordering with RTL support to the `Reorder` component.

Databases, Caching & Vector Search

PostgreSQL's coordinated release (18.6, 17.11, 16.15, 15.19, 14.24, and 19 Beta 3) on Aug 13 fixes 28 security issues and 110+ bugs in one sweep — note that 18.5 was never shipped due to a regression, so 18.4 installations jump straight to 18.6. pgvector 0.8.6 fixes a 32-bit IVFFlat build-time buffer overflow.

MongoDB's Canadian Centre for Cyber Security advisory AV26-810 flags driver and server issues fixed in Driver 5.9.2 and Server 7.0.40/8.0.29/8.2.13/8.3.8/9.0.0-rc2 — worth confirming against MongoDB's own advisories page before treating specific CVE counts as final. ClickHouse continues an active 26.8/26.3 LTS patch cadence, building on 26.7's ~40x faster phrase search via token-position text indexes. DuckDB's most recent stable is v1.5.5 (Jul 22); the project passed 40,000 GitHub stars on Aug 5.

Database Tools, ORMs & BaaS

Prisma Compute reached general availability (Aug 28) with a published Free tier (1M requests/month) and per-branch environments; Prisma 8 now lets you author expression, partial, and unique indexes directly in schema. Drizzle ORM's stable npm tag is still 0.45.2 — the long-running v1.0 line remains at release-candidate 5 (`1.0.0-rc.5`, Aug 11-12) with no GA yet.

Supabase moved read-replica management from Database → Replication into Project Settings → Infrastructure, fixed a scheduling bug that was silently skipping daily backups, and switched its self-hosted stack's default API gateway from Kong to Envoy. Firebase's Apple SDK v12.18.0 removed the deprecated Imagen APIs following the Imagen shutdown, pointing developers to the new Gemini image models.

Background Jobs, Messaging & Task Queues

Temporal had the busiest month here: Serverless Workers for AWS Lambda reached Public Preview (managed scaling, no infrastructure to run), followed by a Cloud Run equivalent and a new "Projects" construct for organizing Cloud resources — all in Pre-Release. Worker Performance (Poller Autoscaling) reached GA. RabbitMQ 4.3.5 fixes duplicate direct reply-to delivery and a rolling-upgrade quorum-queue query failure. BullMQ shipped Node v6.3.2 alongside parallel releases across its Python, Rust, and Elixir backends, reflecting the v6 pluggable-backend architecture. Apache Kafka has nothing newer than 4.3.1 (Jun 25) — no update in this cycle.

Sources & Methodology

This digest was compiled from official vendor changelogs, GitHub Releases pages, npm registry publish timestamps, and CVE/security-advisory records, with every version number and CVE ID cross-checked against a primary source before inclusion. Links to the original release notes and advisories are inlined throughout each section above.