Next.js, Keycloak & Hono Patch Critical CVEs This Week

Executive Summary

• Next.js ships a security release patching 9 CVEs (4 High, 5 Medium) in the App Router — upgrade to 16.2.11 (Active LTS) or 15.5.21 (Maintenance LTS) immediately.
• Keycloak 26.7.0 fixes a TOCTOU privilege-escalation bug (CVE-2026-9796) and adds an Admin API v2, Identity Brokering API v2, and Shared Signals Framework support.
• Authentik 2026.5.5 / 2026.2.6 close a High-severity (CVSS 8.7) SAML account-takeover flaw, CVE-2026-57580, caused by NameID comment-truncation.
• Hono discloses three Moderate CVEs (JSX context leakage, unescaped CSS class names, API Gateway header de-duplication) — all already fixed upstream since v4.12.27.
• Node.js pre-announces a security release for the 26.x, 24.x, and 22.x lines landing on or shortly after July 27, 2026, rated High severity.
• Docker Desktop 4.83.0 fixes a VM-panic bug (CVE-2026-8936) and a host-root privilege escalation (CVE-2026-31431).
• Express's body-parser dependency patches a DoS flaw, CVE-2026-12590, triggered by a malformed limit option.
• Django 6.0.7 / 5.2.16 close three low-severity CVEs, including a cache-middleware session-cookie leak.
• Vue 3.6 enters release-candidate with Vapor Mode — its no-virtual-DOM compiler mode — now feature-complete.
• Nuxt 4.5.0 rebuilds its toolchain on Vite 8 and a new Rspack-based Rsbuild pipeline, with SSR streaming and a stable error-code system.
• shadcn/ui adds React Aria as a first-class component base; Radix UI 1.6.4 ships accessibility and tree-shaking fixes.
• PostgreSQL 19 Beta 2 introduces native SQL/PGQ graph queries; Redis 8.10-RC2 enters release-candidate with roughly 50 new features.

Identity & Authentication (IAM)

Keycloak 26.7.0

Released July 9, 2026, Keycloak 26.7.0 is a major update. It adds an Identity Brokering API v2, a declarative Admin API v2 for client management, Shared Signals Framework (SSF) support, AuthZEN authorization API support, and SAML step-up authentication.

It also patches CVE-2026-9796 (a TOCTOU bug in role renaming that let an attacker escalate to realm-admin, CVSS 6.5), CVE-2026-9689 (OIDC HTTP parameter pollution), CVE-2026-9798 (CIBA flow bypassing brute-force lockout), and CVE-2026-11986 (unauthorized role unassignment).

Breaking changes: the deprecated Twitter IdP has been removed, along with token-exchange-external-internal:v2 support and the persistent-sessions batching option.

Source: Keycloak 26.7.0 released

Authentik: SAML account-takeover fix (CVE-2026-57580)

Authentik 2026.5.5 and 2026.2.6 (released July 15, 2026) fix CVE-2026-57580 (CVSS 8.7, High): an attacker with any account on a federated SAML identity provider could insert XML comments into a signed NameID to truncate the matched identifier and hijack an existing local user's account — no password required.

Only SAML Sources using non-default USERNAME_LINK or EMAIL_LINK matching modes are affected; default unique-identifier matching is safe. If you run Authentik with SAML sources, check your matching mode before anything else today.

The same disclosure batch (July 15, 2026) also covered an LDAP Source debug-endpoint exposure, RAC credential exposure, a Chrome device-trust bypass, and an SSF stream-management access-control gap — see the Authentik security advisories.

Auth.js / next-auth 4.24.15

Published July 20, 2026 (with a companion 5.0.0-beta.32), this is a security-focused patch for the 4.x line: getToken() now returns null instead of throwing on malformed Bearer headers; OAuth state/nonce/PKCE cookies are now cryptographically bound to the originating provider (in-flight sign-ins need a retry after upgrading); and email addresses are Unicode-normalized (NFKC) before validation, closing a homoglyph @ bypass.

npm install [email protected]
# or, if you're on the v5 beta line:
npm install [email protected]

Source: next-auth v4.24.15 release notes

Clerk & Auth0

Clerk announced on July 16, 2026 that it will retire CBC-mode TLS cipher suites on managed subdomains starting January 18, 2027 as certificates rotate — a forward-looking hardening notice, not an immediate breaking change (changelog). SAML connections also gained configurable login-hint behavior on July 15, 2026.

Auth0 moved anonymous sessions into beta on July 20, 2026: a new POST /anonymous/token endpoint gives unauthenticated users (guest checkout, pre-login personalization) a stateless session with a configurable lifetime (Auth0 changelog).

Meta-Frameworks & Core Web Standards

Next.js: July 2026 security release

On July 20-21, 2026, Vercel shipped the Next.js July 2026 Security Release — nine CVEs across the App Router, patched in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS), and backported into 16.3.0-canary.92.

• High: CVE-2026-64641 — Server Actions DoS via CPU exhaustion.
• High: CVE-2026-64642 — middleware/proxy bypass with Turbopack + single locale.
• High: CVE-2026-64645 — SSRF/open-redirect via attacker-controlled rewrites() hostname.
• High: CVE-2026-64649 — SSRF via Server Actions on custom servers.
• Medium: CVE-2026-64644 (SVG image-optimization DoS), CVE-2026-64646 (unbounded Server Action payload on Edge), CVE-2026-64643 (internal endpoint-ID disclosure), CVE-2026-64648 / CVE-2026-64647 (fetch-cache confusion).

npm install [email protected]
# on the maintenance LTS line:
npm install [email protected]

If you self-host the App Router with custom servers, rewrites, or middleware, treat this as a same-day patch.

React, Vue, Nuxt, SvelteKit, Astro

React shipped a small patch (v19.2.8, 19.1.9, 19.0.8, July 21) improving RSC decoding performance. Notably, React's canonical repository has moved to github.com/react/react, following Meta's donation of React to a new React Foundation under the Linux Foundation.

Vue.js entered release-candidate for 3.6 (3.6.0-rc.2, July 22) with Vapor Mode — a compiler-based, no-virtual-DOM rendering mode — now feature-complete and opt-in for <script setup> and template-only SFCs, alongside a reactivity-core refactor based on alien-signals (Vue core releases).

Nuxt 4.5.0 (July 18) upgrades to Vite 8 and introduces an Rspack-based Rsbuild pipeline, experimental SSR streaming, a stable NUXT_Exxxx error-code system, and a new useLayout composable. Nuxt 3 reaches end-of-life on July 31, 2026 (Nuxt v4.5 blog post).

SvelteKit continues a steady patch cadence (2.70.1, July 19) alongside early 3.0.0-next.11 preview builds that move config into vite.config.js directly (SvelteKit releases). Astro shipped 7.1.3 (July 21) with fixes to image optimization under container CPU limits and Astro.locals handling, building on the Rust-rewritten compiler in Astro 7.0 (Astro releases).

Backend Frameworks & Runtimes

Hono: feature release plus three disclosed CVEs

Hono shipped v4.12.30 and v4.12.31 (July 13 and 18) with routing and SSE fixes. Separately, on July 21, 2026, three Moderate-severity advisories were publicly disclosed — all already fixed upstream since v4.12.27 (June 23):

• CVE-2026-59896 — hono/jsx didn't isolate request context, letting concurrent async SSR leak useContext() values across requests.
• CVE-2026-59895 — cx() in hono/css marked class-name strings as pre-escaped without HTML-escaping, enabling SSR XSS via a JSX class attribute.
• CVE-2026-59897 — the AWS API Gateway v1 adapter de-duplicated repeated header values by substring match instead of exact match.

npm install hono@^4.12.31

Node.js: security release pre-alert for July 27

Node.js posted a pre-alert on July 21, 2026 for the 26.x, 24.x, and 22.x lines, rated High severity, with patches expected on or shortly after July 27, 2026. No CVE numbers have been disclosed yet — standard practice ahead of a coordinated release. Plan an upgrade window for next week.

Express, Django, Laravel, FastAPI

Express core hasn't shipped since May, but its body-parser dependency patches CVE-2026-12590 (Low severity, July 20): an invalid limit option silently disabled body-size enforcement, opening a DoS path. Fixed in [email protected] and 1.20.6.

Django 6.0.7 and 5.2.16 (July 7) close three low-severity CVEs: a cache-middleware bug that could store a response setting a sensitive cookie (CVE-2026-48588), a ~32-byte heap over-read in GDALRaster (CVE-2026-53877), and a DomainNameValidator newline-injection issue (CVE-2026-53878). Source: Django security releases.

Laravel published v13.21.0 and v13.21.1 on July 21 (thin changelogs); the last substantive entry, v13.20.0 (July 14), added first-party image-processing support and new QueueFake hooks. FastAPI 0.139.2 (July 16) made router route-building thread-safe for parallel test runs.

No meaningful update in the last few days for NestJS, Fastify, or ElysiaJS's stable channel — reported here rather than stretched to look current.

Containers, Edge & Infrastructure

Docker Desktop 4.83.0

Released July 20, 2026 (bundling Docker Engine v29.6.2 and Compose v5.3.1), this build fixes kubectl exec/attach against Kubernetes v1.36 and a malformed daemon.json being silently overwritten. It also carries fixes for CVE-2026-8936 (CVSS 8.2 — a grpcfuse kernel-module recursion bug that can panic the Docker Desktop VM via deeply nested bind-mounted directories) and CVE-2026-31431 (a privilege escalation to host-VM root). Source: Docker Desktop release notes.

Podman, Kubernetes

Podman v6.0.2 (July 22) fixes WSL provider VM cleanup and Windows installer path bugs. It follows v6.0.0's fix for CVE-2026-57231, a malicious-image environment-variable leak (Podman releases). Kubernetes v1.37 has its code/test freeze scheduled for July 23, 2026 (tomorrow) — no new CVE was confirmed as dated this week via the official CVE feed.

Cloudflare, Vercel, AWS, Railway, Render

Cloudflare shipped an emergency WAF release on July 17, deprecated legacy Workers KV namespace routes (migrate before Oct 15, 2026), and released @cloudflare/workers-types v5 — a breaking trim for pinned-version consumers.

Vercel's platform changelog (July 20-21) adds precompiled bytecode for Python functions, 90+ Vercel Connect presets, and new AI Gateway models. AWS's weekly roundup (July 20) covers Lambda self-managed code storage via S3, GPT-5.6 models GA on Bedrock, and same-day S3 Standard-IA/One Zone-IA transitions.

Railway added a Grok build-agent marketplace plugin and a railway cdn CLI command (July 17). Render shipped a trigger_deploy MCP tool, switched new services to Bun 1.3.14 by default, and brought Render-to-AWS OIDC auth to GA for Pro workspaces.

UI Systems, Styling & Motion

shadcn/ui added React Aria as a first-class component base (July 17) — selectable via --base aria on CLI init, alongside the existing Base UI and Radix options, with no impact on existing projects (shadcn/ui changelog).

npx shadcn@latest init --base aria

Radix UI v1.6.4 (July 20) fixes broken ARIA references in Dialog, a Slider.onValueCommit firing bug, and adds new subpath entry points for better tree-shaking (import { Accordion } from "radix-ui/accordion"). Tailwind CSS v4.3.3 (July 16) is a 14-fix patch release including improved --watch --poll behavior. No recent release was found for Material UI (latest: 9.2.0, July 3) or Motion/Framer Motion (latest: 12.42.2, June 30) — both are reported as stale rather than stretched.

Databases, Caching, ORMs & Task Queues

PostgreSQL 19 Beta 2 (July 16) introduces native SQL/PGQ graph queries and a unified REPACK command for zero-downtime table reorganization, with GA targeted for Sept/Oct 2026 (release notes). pgvector v0.8.5 (July 8) reduces IVFFlat index-build memory use on small tables.

Redis 8.10-RC2 (July 20) fixes an error-reply escape-sequence injection found in RC1 and rolls in roughly 50 features across core Redis, Search, JSON, TimeSeries, and Bloom (Redis releases). ClickHouse shipped routine stable/LTS patch builds through the week; no recent release was found for MongoDB (latest: 8.0.26, June 11), DuckDB (latest: v1.5.4, June 17), or Firebase JS SDK (latest: v12.16.0, July 9).

Prisma published v7.9.0 to npm (July 20) and added Row-Level Security policy authoring for Prisma Next + Supabase (July 17). Drizzle ORM is closing in on a stable 1.0 with near-daily 1.0.0-rc.4 canary builds. Supabase moved Pipelines (managed CDC streaming to BigQuery) into public alpha on July 21, and will switch self-hosted Supabase's default API gateway from Kong to Envoy the week of Aug 9, 2026 — a breaking change for self-hosters (Supabase changelog).

BullMQ shipped five patch releases in the last week alone (v5.80.6 through v5.80.10), including a stalled-jobs worker fix and a shared-Scripts-instance performance improvement. RabbitMQ 4.3.3 and 4.2.9 (July 20) bump the minimum supported Erlang to 27.0 and switch password-salt generation to a CSPRNG.

# Check your Erlang version before upgrading RabbitMQ to 4.3.3 / 4.2.9
erl -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' -noshell

Temporal v1.31.2 / v1.30.6 (July 8, just outside this week's window) fix CVE-2026-5724 (Medium) in the replication/authorization streaming endpoint; a dynamic-config workaround exists if you can't upgrade immediately. No update was found this week for Apache Kafka (latest: 4.3.1, June 25).

What Didn't Move This Week

In the interest of an honest audit, not a hype cycle: Material UI, Motion/Framer Motion, MongoDB, DuckDB, Firebase, Apache Kafka, NestJS, Fastify, Express core, and ElysiaJS's stable channel had no meaningful release in the last several days. Cloudflare Pages specifically also saw no update this cycle beyond the broader Workers/KV/R2 changes above.