Express 5.3 Security Fixes, Nuxt 4.6.1 and Hono 5 RC

Executive Summary

• Security: Express 5.3.0 bumps qs, proxy-addr (CVE-2026-90711) and body-parser (CVE-2026-12590); invalid body-parser limits now throw instead of silently disabling size enforcement.
• Nuxt: v4.6.1 ships one performance change and about 25 fixes across Vite, Nitro, Kit and hydration.
• Pre-releases to watch: Hono 5.0.0-rc.1, Vue 3.6.0-rc.11, Elysia 2.0.0-beta.30 and Next.js 16.5.0-canary.8.
• UI: MUI 9.5.0 adds getOptionValue to Autocomplete; Motion 14.1.0 and Auth0 SDK 7.4.0 also shipped.
• Calendar: Next.js has an out-of-band security update scheduled for October 14, and Node.js 24 enters Maintenance LTS on October 20.

Audit window: October 9 to October 12, 2026, checked against the npm registry and GitHub release pages. Packages with no new release in that window (Fastify, NestJS, Svelte, SvelteKit, Astro, Drizzle, Better Auth, Auth.js, Firebase, Wrangler) are omitted.

Express 5.3.0: dependency security fixes

Express 5.3.0 was published on October 9. The security-relevant changes are dependency upgrades: qs to ^6.16.0 (arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer), proxy-addr to ^2.0.8 for CVE-2026-90711, and body-parser to ^2.3.0 for CVE-2026-12590. Verify the CVE IDs against the CVE database before triaging.

The body-parser change can break startup if you pass a malformed limit, because previously an invalid value silently turned size enforcement off. Use a valid size string:

import express from "express";
const app = express();
// An invalid limit such as "10 megs" now throws at init
app.use(express.json({ limit: "1mb" }));

Other changes: req.fresh handles QUERY requests, res.redirect() HTML bodies include a doctype, the default error handler logs the full error including Error.cause, and content-disposition v2 no longer quotes token-safe filenames, which can break tests asserting exact header bytes. Upgrade with:

npm install [email protected] && npm audit

Nuxt 4.6.1

Nuxt v4.6.1 (October 9) is a patch release. Notable fixes: setPageLayout accepting false, $fetch and baseURL typing, nitropack/types under nodenext, Windows path resolution in Nitro, a BroadcastChannel fallback, and preserving onServerPrefetch for useId during hydration.

Hono 5 release candidate

Hono v5.0.0-rc.1 was tagged on October 10. The release page carries no notes, so breaking changes are not yet documented; hold off on upgrading production services and track the tag. The stable line on npm is still 4.13.13. The same pattern applies to Elysia, where 2.0.0-beta.28 through beta.30 landed October 9 and 10 while 1.4.30 remains latest.

Vue 3.6.0-rc.11

Vue 3.6.0-rc.11 was published on October 10. Details live in the CHANGELOG on the minor branch; the npm latest tag is still 3.5.43.

Next.js: canaries and the October 14 security update

Next.js 16.4.0 remains the stable release; canaries 16.5.0-canary.5 to canary.8 shipped October 9 and 10. Plan for the announced security update on October 14, and note that Next.js 15 LTS reaches end of security support on October 21 per endoflife.date.

UI libraries and auth SDKs

• MUI 9.5.0 (October 9): getOptionValue for Autocomplete so options can be primitive values, fixes for Tabs, Slider, Select and Snackbar, and theme.alpha() with CSS variables.
• Motion 14.1.0 (October 9): tagged without published notes.
• BullMQ 6.3.12 and Auth0 7.4.0 appeared on npm on October 9 without notes we could verify; check the BullMQ and auth0 package pages before upgrading.

Upcoming dates

Node.js 24 moves to Maintenance LTS on October 20 and Node.js 26 to Active LTS on October 28, per the NodeSource weekly. Django also published four security fixes on October 6 for 6.1, 6.0 and 5.2; see the Django security archive.

Coverage gaps

This audit could not verify same-day releases for Docker, Kubernetes, PostgreSQL, Redis, MongoDB, ClickHouse, DuckDB, Keycloak, Authentik, Laravel, Kafka, RabbitMQ or Temporal because GitHub API access was unavailable and web sources were inconclusive. They are not reported as unchanged.