Daily Stack Watch: Nuxt, Redis, MongoDB and Node.js Ship Critical Patches

Release audit for July 30, 2026 — containers, identity, meta-frameworks, backend runtimes, UI systems, and data infrastructure.

Executive Summary

• Nuxt 4.5.1 / 3.21.10 is a security release fixing a server-side RCE via template injection in server-island props, plus three more advisories (unauthorized component instantiation, unauthenticated CPU-exhaustion DoS, and an OOM crash via unbounded v-for) — details.
• Redis 8.8.1 patches a critical RESTORE-payload vulnerability in the RedisBloom/TDigest modules that could trigger out-of-bounds writes — release.
• MongoDB Server 8.2.12 closes 21 CVEs in one release, including compound wildcard index handling and mongos killCursors authorization gaps — release notes.
• Node.js 26.5.1 / 24.18.1 / 22.23.2 ship a coordinated security release fixing 11 CVEs, two rated HIGH — advisory.
• Docker Engine 29.6.2 patches five BuildKit CVEs, including a git-bundle checkout command-injection bug and a WCOW cache-mount NTFS junction escape — notes.
• Podman v6.0.2 fixes CVE-2026-57231 (malformed Env entries leaking host environment variables into built containers) — releases.
• Temporal Server 1.31.2 closes CVE-2026-5724 by adding authorization checks to the replication streaming endpoint — release.
• BullMQ 5.81.3, released today, patches a Redis-dependency security issue and upgrades msgpackr for a related fix — releases.

Containers, Edge & Infrastructure

Docker

Engine 29.6.2 (Jul 16) patches five BuildKit CVEs: CVE-2026-15793 (git-bundle checkout command injection), CVE-2026-15792 (frontend panic), CVE-2026-15791 (LLB file ops could wipe /tmp), CVE-2026-15789 (destination-directory validation bypass), and CVE-2026-15788 (WCOW cache-mount NTFS junction escape). Desktop 4.84.0 (Jul 27) fixed a config-file bug causing hangs, and prior 4.82–4.83 builds mitigated CVE-2026-31431 ("Copy Fail," CVSS 7.8, an AF_ALG privilege-escalation flaw). Compose v5.3.1 (Jul 7) is a routine dependency bump.

docker version              # confirm Engine >= 29.6.2
docker compose version      # confirm Compose >= 5.3.1

Reference: Engine 29 release notes

Cloudflare

Workers KV's legacy namespace API is deprecated and shuts off Oct 15, 2026 — migrate to the new storage/kv namespace routes (changelog). New tracing.startActiveSpan() / span.end() APIs let Workers create custom spans that outlive a single request (changelog). @cloudflare/workers-types v5 (Jul 3) is a breaking simplification that only exposes the latest runtime types.

Vercel

AI SDK 7.0.19 adds fingerprintTools and detectToolDrift to guard against MCP "rug pull" tool-poisoning attacks. Build logs now redact "Sensitive" env-var values 32+ characters. Sandbox.fork() seeds a new sandbox from a source's latest snapshot (changelog).

Kubernetes & Podman

Kubernetes v1.36.2 (patch, Jun 9) sits on the v1.36 line, which brought User Namespaces to GA and CEL-based Mutating Admission Policies to GA, replacing webhook mutations (releases). Podman v6.0 is a breaking-change major release: cgroups v1, iptables, CNI networking, slirp4netns, and BoltDB support are all dropped in favor of cgroups v2, nftables, Netavark, and Pasta. v6.0.2 (~Jul 21) fixes CVE-2026-57231 and Podman Machine/WSL cleanup bugs (releases).

Cloud Platforms

AWS shipped its quarterly Amazon Corretto update (Jul 22): Corretto 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, 8u502, now on Amazon Linux 2023 base images (announcement). Railway added DNS logs to its dashboard and a railway api CLI command (Jul 24, changelog). Render's Managed OIDC now supports Anthropic and OpenAI identity providers alongside AWS, and new services default to Bun 1.3.14 (changelog).

Identity & Authentication (IAM)

Keycloak

26.7.0 (Jul 9) adds a preview SCIM API for automated provisioning, a Multi-Cluster HA v2 preview that drops the external Infinispan cache requirement, and promotes SAML Step-Up Authentication to fully supported. Community trackers reference several CVEs near this release window, but Keycloak's own 26.7.0 notes don't enumerate CVE IDs directly — treat the CVE-to-version mapping as unconfirmed pending an official security advisory (release notes).

Authentik

2026.5.6 (Jul 22) introduces enterprise Account Lockdown for immediately deactivating compromised accounts, open-sources the AKQL search query language, and ships a Rust-based worker entrypoint that cuts about 200MB of memory per worker. Note the breaking change: default listen address moved from 0.0.0.0 to [::], which can affect IPv4-only deployments (release notes).

Clerk

Hosted Authentication for Mobile (Jul 28) lets Expo/iOS/Android apps delegate sign-in to Account Portal in-browser. A new clerk mcp install CLI command (Jul 22) auto-registers Clerk's MCP server across ten AI clients. Security note: CBC-mode TLS ciphers on managed subdomains begin phasing out Jan 18, 2027, in favor of AEAD ciphers (changelog).

Auth0

Cross App Access (XAA), an open standard for cross-domain authorization for "Enterprise AI" use cases, entered open early access Jul 27. Third-Party Apps for Organizations reached General Availability Jul 10 (changelog).

Better Auth / Auth.js (NextAuth)

Better Auth 1.6.25 (Jul 23) fixes an Apple OAuth PKCE code-challenge omission that broke token exchange, and stops Google One Tap from creating unwanted accounts when sign-up is disabled. Better Auth's team now maintains Auth.js/NextAuth.js, which continues to receive security-only fixes; NextAuth.js 4.24.15 (Jul 20) hardens getToken() to return null instead of throwing on malformed Bearer headers, binds OAuth state/nonce/PKCE cookies per-provider, and applies Unicode (NFKC) email normalization to block homoglyph bypasses (Better Auth changelog).

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js 16.2.12 (Jul 25) is a backport release for TypeScript 7.0+ compatibility; 16.3.0 previews are in canary with Partial Prerendering and HMR performance work (release). React 19.2.8 (Jul 21) improves React Server Components decoding performance, continuing a run of RSC/Server Actions hardening that included a FormData regression fix in 19.2.7.

Nuxt & Vue.js

Nuxt 4.5.1 / 3.21.10 (Jul 27) is this week's most urgent security release — see the executive summary above. It also patches a regression in the fix for CVE-2026-53721, a route-rule/middleware bypass from a case-sensitivity mismatch between vue-router and the routeRules matcher (CVSS 8.8). The 3.x line reaches end-of-life Jul 31, 2026, so teams still on Nuxt 3 should plan the 4.x migration now. Vue 3.5.40 (Jul 16) is bug fixes only; Vue 3.6.0-rc.2 previews an alien-signals-based reactivity rewrite and a completed Vapor Mode (compiled, virtual-DOM-free rendering).

npm i [email protected]   # or [email protected] on the 3.x line — apply immediately

References: Nuxt 4.5.1 release · GHSA-9473-5f9j-94wq

SvelteKit & Svelte

SvelteKit 2.70.2 (Jul 29) fixes ReDoS-style backtracking in Accept-header content negotiation. In parallel, 3.0.0-next.13 previews Kit 3 breaking changes: a unified navigation "reset" param and a deprecated error() signature. Svelte 5.56.8 (Jul 24) fixes hydration of failed error boundaries and <select> value handling with spread attributes.

Astro

[email protected] (Jul 29) fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes, and stale dev-server CSS after editing component <style> blocks.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS 11.1.28 (Jul 8) fixes SSE Observable teardown on client disconnect and bumps its Fastify adapter to 5.10.0. Node.js's coordinated security release (Jul 29, one day later than scheduled) fixes 11 CVEs across the 26.x, 24.x, and 22.x lines — two rated HIGH — plus bundled undici and llhttp updates.

nvm install 22.23.2   # or 24.18.1 / 26.5.1 — apply the security release for your line

Reference: Node.js July 2026 security releases

Fastify & Express

Fastify 5.10.0 (Jul 5) reduces per-request overhead and fixes socket metadata cleanup during reply hijacking. Earlier in the year, v5.8.3 fixed CVE-2026-3635: request.protocol/request.host were spoofable via X-Forwarded-Proto/X-Forwarded-Host when trustProxy used a restrictive trust function — a bypass for HTTPS/CSRF/cookie checks worth re-verifying if you're still on an older 5.x release.

const app = fastify({
  trustProxy: (address) => address === '127.0.0.1' || address === '::1',
})

Express 4.22.2 (May 11) restores repeated-query-key/array-notation parsing beyond the prior 20-item cap, up to 1000 elements. Express 5.x's latest is v5.2.1, which reverted an unintended breaking change to the extended query parser and confirms CVE-2024-51999 was rejected as not a real vulnerability.

ElysiaJS & Hono

ElysiaJS 1.4.29 (Jun 16) optimizes multipart/form-data parsing. Hono v4.12.32 (Jul 24) adds JWT/Lambda authorizer types for API Gateway v2 and hardens query/header/param parsing with Object.create(null) as a prototype-pollution mitigation.

FastAPI & Django

FastAPI 0.141.1 (Jul 29) fixes background-task/header support in app.frontend(). Django's most recent security releases (6.0.2, 5.2.11, 4.2.28, Feb 3) patched six CVEs, most notably CVE-2026-1207 — a SQL injection via raster lookups on PostGIS reported as actively exploited — plus further CVEs disclosed Jul 7 (CVE-2026-48588, CVE-2026-53877/78). Confirm your Django install is current if you haven't patched since February.

Laravel

Laravel 13.21 (~Jul 22) adds a #[RouteKey] attribute for Eloquent route-model binding and a base64 validation rule, building on Laravel 13's first-party AI SDK and native pgvector semantic search.

UI Systems, Styling & Motion

shadcn/ui & Radix UI

shadcn/ui v4.16.0 (Jul 27) makes Base UI the default component library for new projects — Radix remains fully supported via the -b radix flag, and existing Radix projects need no migration. React Aria joins as a third first-class primitives base. Radix UI consolidated into a unified radix-ui npm package (v1.6.7, Jul 24), improving tree-shaking and per-primitive subpath entry points.

npx shadcn init            # now defaults to Base UI
npx shadcn init -b radix    # keep using Radix UI primitives

Reference: shadcn/ui changelog

Tailwind CSS

v4.3.3 (Jul 16) adds --watch --poll[=ms] to the CLI for unreliable filesystem-event environments and fixes hex-color canonicalization against theme colors in oklch space. No breaking changes since v4.3.0's @container-size, scrollbar-*, and stacked @variant support.

Material UI (MUI)

@mui/material v9.2.0 (Jul 3) adds data-* attribute support on slotProps with an opt-in TypeScript augmentation — no breaking changes.

Motion (Framer Motion)

v12.43.0 (Jul 27) adds hardware acceleration for backgroundColor animations and SVG elements, and fixes AnimatePresence interleaving exiting/entering children present in both renders.

Databases, Caching & Vector Search

PostgreSQL & PgVector

PostgreSQL's May 14 rollup (18.4 / 17.10 / 16.14 / 15.18 / 14.23) fixed 11 security issues, including a CREATE TYPE missing-authorization flaw enabling search_path hijacking; PG 19 Beta 2 followed Jul 16 (announcement). pgvector 0.8.6 (Jul 29) fixes a buffer overflow in IVFFlat index builds on 32-bit systems.

Redis

8.8.1 (Jul 23) — see executive summary; this is a security-critical upgrade for anyone running RedisBloom/TDigest modules. Confirm your deployment is patched:

redis-cli INFO server | grep redis_version   # expect >= 8.8.1

Reference: Redis 8.8.1 release

MongoDB

Server 8.2.12 (Jul 22) closes 21 CVEs, plus separately-tracked CVE-2026-8053 (out-of-bounds write, patched across 5.0.33–8.3.2) and CVE-2026-11933 (fixed in 8.2.11). If you're running any MongoDB 5.x–8.x line, check your patch level against the 8.2 release notes.

ClickHouse & DuckDB

ClickHouse v26.7 (Jul 22) hardens S3 credential resolution so server credentials are no longer auto-resolved for user queries by default, and adds EXPLAIN ANALYZE and new vector-search functions. DuckDB v1.5.5 (Jul 22) backports out-of-bounds security fixes in JSON path operations and string-to-struct casting.

Database Tools, ORMs & BaaS

Prisma ORM

v7.9.1 (Jul 27) patches a security advisory in a transitive CLI dependency. v7.9.0 added shell tab-completion and expanded AI-agent safety guards against destructive database operations (changelog).

Drizzle ORM

The stable npm channel remains v0.45.2; the 1.0 migration is progressing through release candidates (1.0.0-rc.4, with prerelease builds through Jul 21) but hasn't yet been promoted to latest.

Supabase & Firebase

Supabase fixed a metrics-collection panic under concurrent requests (Jul 29) and announced a breaking change: the logs.all analytics endpoint is deprecated in favor of a ClickHouse-backed logs endpoint, with removal Sep 23, 2026. Firebase JS SDK v12.16.0 (Jul 9) adds startChat() with auto function-calling and support for Gemini 3.6-flash/3.5-flash-lite models.

Background Jobs, Messaging & Task Queues

BullMQ

v5.81.3, released today (Jul 30), upgrades msgpackr to v2.0.5 for a security fix, patches a Redis-dependency security issue, and fixes blocking clients failing to recover after Sentinel disconnects — an immediate-upgrade candidate (releases).

RabbitMQ & Apache Kafka

RabbitMQ 4.3.4 (Jul 23) continues the 4.3.x line; minimum supported Erlang was bumped to 27.0 as of 4.2.9. Apache Kafka 4.3.1 (Jun 25) resolves roughly 15 issues, including a critical Kafka Streams RocksDB native memory leak (KAFKA-20616).

Temporal

Server v1.31.2 (Jul 8) fixes CVE-2026-5724 (medium severity) by adding authorization coverage to the replication streaming endpoint. Existing replication setups can opt out via system.disableStreamingAuthorizer, but new deployments should leave it enabled (release).

This audit reflects publicly available changelogs, GitHub releases, and security advisories as of July 30, 2026. Some items sourced from community trackers rather than vendor security advisories are flagged as unconfirmed in-line; verify against your vendor's official advisory before taking action on any specific CVE.