Node.js Patches 11 CVEs as BullMQ Ships Breaking v6.0.0

Today's stack audit surfaces two stories that matter more than the rest: a coordinated Node.js security release patching 11 CVEs across three active lines, and BullMQ's breaking v6.0.0, published July 30 and followed by a same-day v6.0.1 patch. Alongside those, Keycloak, Firebase, and Redis all shipped security fixes this week, and the meta-framework, IAM, and infrastructure ecosystems kept up their usual weekly cadence.

Executive Summary

• Node.js 22.23.2, 24.18.1 (LTS), and 26.5.1 fix 11 CVEs, including two HTTP/2 issues, a Permission Model over-grant, and a TLS hostname verification bypass — full advisory.
• BullMQ v6.0.0 introduces pluggable queue backends as a breaking change across the JS, Python, PHP, Elixir, and Rust packages; v6.0.1 landed the same day to fix missing SQL files in the published package.
• Keycloak 26.7.0 fixes four CVEs, including a realm-wide privilege escalation via admin role rename (CVE-2026-9796) and an OIDC redirect_uri parameter-pollution bug (CVE-2026-9689).
• Firebase JS SDK 12.17.0 patches a ReDoS vulnerability in Firestore's error-template logic and widens the Firestore HTTP/2 flow-control window.
• Redis 8.6.5 closes a Streams use-after-free reachable via a crafted RESTORE payload, plus RedisBloom/TDigest out-of-bounds writes.
• Next.js's July 2026 Security Release (v16.2.11 / v15.5.21) — the first under Vercel's new pre-announced monthly security program — continues to roll out, fixing 8 CVEs spanning Server Actions DoS, a Turbopack middleware bypass, and SSRF via rewrite/redirect hostnames.
• MongoDB Server and Compass are flagged in a Canadian Centre for Cyber Security advisory (AV26-744) covering versions below 7.0.39 / 8.0.28 / 8.2.12 / 8.3.7 and Compass below 1.49.7.
• Docker Desktop 4.83.0 fixed CVE-2026-8936, a VM panic in the grpcfuse kernel module from unbounded recursion on deeply nested bind-mounts — release notes.
• Kubernetes v1.36.3 and Podman 6.0.2 both shipped bugfix releases this week; no new Kubernetes CVE was disclosed in the July 29–31 window.

Runtimes & Backend Frameworks

Node.js — 11 CVEs across three lines

Node.js shipped coordinated security releases on July 29 for the 22.x, 24.x, and 26.x lines: v22.23.2, v24.18.1 (Active LTS), and v26.5.1. The named issues include:

• CVE-2026-56846 / CVE-2026-56848 — high-severity HTTP/2 issues
• CVE-2026-58043 — Permission Model over-grants filesystem access
• CVE-2026-58040 / CVE-2026-56850 — HTTPS Agent / TLS hostname verification bypass
• CVE-2026-58041 — node:sqlite iterator replay
• CVE-2026-58042 — dns.resolveAny crash
• CVE-2026-58045 — node:zlib crash

Bundled undici and llhttp were also bumped. Remaining lower-severity items touch the Permission Model and the HTTP parser. Full details: nodejs.org/en/blog/vulnerability/july-2026-security-releases.

# Upgrade to the patched LTS line
nvm install 24.18.1
nvm use 24.18.1
node -v

Python & PHP

FastAPI shipped v0.141.1 on July 29, fixing background-task/header support in app.frontend() and SSE streaming edge cases. Django's most recent security release remains 6.0.7 / 5.2.16 from July 7, patching three low-severity issues (cached Set-Cookie data leakage, a GDALRaster buffer over-read, and header injection via DomainNameValidator). Laravel continues its weekly point-release cadence, with v13.23.0 landing around July 27 adding a monthly log driver and a timing-safe maintenance-mode comparison.

No notable update this week

NestJS (last: v11.1.28, July 8), Fastify (last: v5.8.3, March 23), Express (last: v4.22.2, May 11), Hono (last: v4.12.18, May 6), and ElysiaJS (last: v1.4.29, June 16) had no release activity in the July 29–31 window.

Meta-Frameworks & Core Web

Next.js — monthly security program debuts

Vercel's new pre-announced monthly security program made its first delivery on July 20 with patches for v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS), covering 8 CVEs from a Server Actions CPU-exhaustion DoS to SSRF via attacker-controlled rewrite hostnames and disclosure of internal Server Function endpoint IDs. Full advisory: nextjs.org/blog/july-2026-security-release. The canary train has since moved to v16.3.0-canary.104 with TypeScript 7 compatibility fixes landing in v16.2.12 / v15.5.22 on July 25.

Nuxt — patch your DevTools

Nuxt's own security release (4.5.1 / 3.21.10, plus @nuxt/devtools 3.3.1) shipped July 27 and was covered in yesterday's stack audit — it remains the top action item for Nuxt teams this week if not yet applied, closing a critical dev-only DevTools RCE and a high-severity server-side RCE via server island props. Details: vercel.com/changelog/nuxt-july-2026-security-advisory. Separately, Nuxt 3 officially reaches end-of-life today, July 31, 2026.

Vue, SvelteKit, Astro

Vue 3.6 entered release-candidate status on July 18 with Vapor Mode now feature-complete and a rewritten @vue/reactivity based on alien-signals — see the core releases page. SvelteKit shipped @sveltejs/[email protected] on July 29, fixing a quadratic-backtracking DoS-adjacent bug in Accept-header content negotiation, alongside a 3.0.0-next.13 pre-release. Astro pushed routine patch releases 7.1.5 and 7.1.6 on July 28–29 covering concurrent static builds and stale dev CSS.

Identity & Authentication

Keycloak — four CVEs, zero-downtime patching now default

Keycloak 26.7.0 (July 9) fixes CVE-2026-9796 (admin role rename TOCTOU leading to realm-wide privilege escalation), CVE-2026-9689 (HTTP parameter pollution in OIDC redirect_uri), CVE-2026-9798 (CIBA flow bypassing brute-force lockout), and CVE-2026-11986 (FGAP v1 allowing unassigned role usage). It also enables zero-downtime patch releases by default and adds a preview SCIM provisioning API.

Authentik, Clerk, Auth0, Better Auth

• Authentik 2026.5.6 (July 22) backports security patches alongside flow-executor and policy-engine fixes; specific CVE identifiers were not published, so none are cited here.
• Clerk shipped hosted mobile authentication for Expo/iOS/Android on July 28, letting mobile apps delegate sign-in to Account Portal.
• Auth0 opened an Enterprise Connect beta on July 30 for federating an existing IdP as a B2B layer, plus an early-access "Agents as Principal" feature for distinct AI-agent identities.
• Better Auth v1.6.25 (July 23) fixed an Apple OAuth PKCE code-challenge bug and stopped Google One Tap from creating accounts when sign-up is disabled.
• Auth.js / NextAuth had no new release in the window; the project continues pointing new adopters toward Better Auth.

Containers, Edge & Infrastructure

• Docker Desktop 4.84.0 (July 27) fixed a config.json hang and a credential-deletion bug; the prior 4.83.0 patched CVE-2026-8936, a grpcfuse VM panic.
• Cloudflare shipped @cloudflare/workers-types v5 and an Agents SDK update adding MCP 2026-07-28 support.
• Vercel's changelog highlights build-log redaction for sensitive env vars and new Sandbox/ChatGPT sign-in features — full changelog.
• Kubernetes v1.36.3 (July 23) fixes a kube-scheduler panic; Podman 6.0.2 (July 22) ships VM cleanup and installer fixes.
• AWS published quarterly Amazon Corretto updates; Railway added DNS query logs; Render extended OIDC provider support and shipped an MCP `trigger_deploy` tool — Render changelog.

UI Systems, Styling & Motion

shadcn/ui's July changelog makes Base UI the default component library (Radix remains supported), adds React Aria as an alternate base, and ships a new Toast component — full changelog. Radix UI Primitives (July 20) fixed Dialog ARIA references and Toast escape-key handling. Motion shipped a new Motion UI component library and Motion AI Kit 6.2.0 on July 23 — motion.dev/changelog. Tailwind CSS (latest: 4.3.3) and MUI (latest: v9.1.1) had no release in this window.

Databases, Caching & Vector Search

Redis 8.6.5 closes a Streams shared-NACK use-after-free reachable via crafted RESTORE payloads, plus RedisBloom/TDigest out-of-bounds writes — apply promptly given the RCE potential. MongoDB Server and Compass are covered by CCCS advisory AV26-744 (July 24); check versions against 7.0.39 / 8.0.28 / 8.2.12 / 8.3.7. PostgreSQL's 19 Beta 2 (July 16) adds native SQL/PGQ graph queries; its last security release was May 14. DuckDB 1.5.5 (July 22) is a bugfix release including security fixes. ClickHouse's changelog is continuously updated without a single pinned July 29–31 entry. pgvector had no confirmed new release.

Database Tools, ORMs & BaaS

Prisma's most recent changelog entry (July 24) adds S3-compatible "Object Store" buckets alongside Prisma Postgres apps — prisma.io/changelog. Drizzle ORM's v1.0 line remains release-candidate only, with 1.0.0-rc.4 published July 21 — latest releases. Supabase shipped a metrics-collection panic fix on July 29 — changelog. Firebase JS SDK 12.17.0 (July 30) patches a ReDoS in Firestore's error-template logic and widens Firestore's HTTP/2 flow-control window from 64KB to 256KB.

Background Jobs, Messaging & Task Queues

BullMQ's v6.0.0 is the standout release of the day: published July 30, it introduces pluggable queue backends as a breaking architectural change spanning the JS core and companion Python, PHP, Elixir, and Rust packages. A same-day v6.0.1 patch (July 31) fixed missing SQL files in the published package — pin to 6.0.1, not 6.0.0, if you're upgrading today.

npm install [email protected]
# Review the pluggable-backend migration notes before deploying:
# https://github.com/taskforcesh/bullmq/releases/tag/v6.0.0

RabbitMQ's latest is 4.3.4 (July 23), with no new CVE tied to the release. Apache Kafka had no release in July 2026; its most recent is 4.3.1 from June 25. Temporal has no new feature release in the window — the most relevant recent security item is CVE-2026-5724, a moderate missing-authentication bug in the streaming AdminService endpoint, patched in 1.28.4 / 1.29.6 / 1.30.4+ back in April.

What to Patch First

• Node.js 22.23.2 / 24.18.1 / 26.5.1 — 11 CVEs, apply today
• Redis 8.6.5 — RESTORE-triggered use-after-free, RCE potential
• Keycloak 26.7.0 — realm-wide privilege escalation (CVE-2026-9796)
• BullMQ 6.0.1 — do not deploy 6.0.0 directly, missing SQL files
• Nuxt 4.5.1 / 3.21.10 — critical DevTools RCE, if not already patched from yesterday
• MongoDB — verify against CCCS advisory AV26-744 version thresholds