Dev Stack Release Audit — August 13, 2026: Critical CVEs Hit MongoDB, Redis, Keycloak & Node.js

Today's audit sweeps releases, changelogs, and security advisories across roughly thirty tools spanning containers, identity, meta-frameworks, backend runtimes, UI systems, databases, and messaging infrastructure. The headline is security: five separate ecosystems — MongoDB, Redis, Keycloak, Node.js, and Nuxt — shipped patches for critical or near-critical vulnerabilities within the last two weeks, several with public proof-of-concept-worthy detail. If your team runs any of these in production, the security section below is not optional reading.

Executive Summary

• MongoDB Server patched CVE-2026-18691 (CVSS 9.0) — improper authentication in intra-cluster connection setup that can expose credentials — across 19 CVEs fixed in 8.0.29, 8.3.8, and 7.0.40.
• Redis fixed CVE-2026-25589, an out-of-bounds write in the RedisBloom/TDigest RDB loader reachable via a crafted RESTORE payload, patched in 8.8.1.
• Keycloak 26.7.1 is a dedicated security release fixing 12 CVEs, including a JWE signature-enforcement bypass and a hardcoded-role privilege escalation in client management.
• Node.js shipped an 11-CVE security release (26.5.1 / 24.18.1 LTS / 22.23.2) covering HTTP/2 use-after-free, Permission Model over-grants, and HTTP request smuggling via header truncation.
• Nuxt 4.5.1 / 3.21.10 is a critical security release: an unauthenticated DevTools RPC allowed arbitrary command execution on the dev host, and server islands were vulnerable to server-side template injection RCE.
• PostgreSQL 18.4 / 17.10 / 16.14 / 15.18 / 14.23 fixed 11 CVEs including CVSS-8.8 issues in memory-size integer wraparound and libpq large-object stack buffer overwrites.
• Feature-side highlights: Next.js 16.3 reaches LTS with up to 90% lower dev memory use, Vue 3.6-rc ships opt-in Vapor Mode, Supabase self-hosted defaults to Envoy over Kong, and Cloudflare doubled Vectorize index capacity to 20M vectors.

Critical Security Patches You Should Not Delay

Six advisories this cycle cross the threshold of "patch this week, not this quarter." Each is detailed below with the affected versions and the fixed release.

MongoDB Server: unauthenticated privilege exposure (CVSS 9.0)

MongoDB shipped Server 8.0.29, 8.3.8, and 7.0.40 on August 11, 2026, closing 19 CVEs. The most severe, CVE-2026-18691, is an improper-authentication flaw in intra-cluster connection setup that can expose credentials between cluster members. A second issue, CVE-2026-18697 (CVSS 8.7), allows unauthenticated denial-of-service against mongos via malformed aggregation-framework input. CVE-2026-18712 and CVE-2026-18711 round out the high-severity set with an authorization gap in Queryable Encryption maintenance and a use-after-free in the query execution engine.

• Affected: Server 7.0.x before 7.0.40, 8.0.x before 8.0.29, 8.3.x before 8.3.8
• Fix: upgrade immediately, and rotate intra-cluster credentials if you cannot patch today — see the MongoDB Security Alerts page.

Redis: RDB deserialization RCE path (CVE-2026-25589)

A crafted RESTORE command targeting the RedisBloom/TDigest module's RDB loader can trigger an out-of-bounds write via an attacker-controlled capacity field — a classic path toward remote code execution on any instance that accepts untrusted RESTORE payloads. Fixed in Redis 8.8.1, with backports to 8.6.5, 8.4.5, 8.2.8, 7.4.10, 7.2.15, and 6.2.23. It's part of a broader May 2026 advisory batch (CVE-2026-23479, -25243, -25588, -25589, -23631) — if you're still on an older 7.x or 6.x line, check the full advisory for your exact backport version.

redis-cli --version # confirm you are on a patched build
# then upgrade via your package manager or container image tag

Keycloak 26.7.1: 12-CVE security release

Keycloak's dedicated patch release, 26.7.1, fixes twelve vulnerabilities spanning admin, SAML, Dynamic Client Registration, and LDAP. The two worth flagging to your security team: CVE-2026-9793, where a JWE-encrypted request object bypasses the configured requestObjectSignatureAlg enforcement, and CVE-2026-4629, a privilege escalation via hardcoded role-mapper injection reachable from the manage-clients permission. SAML broker login also had two bypasses (CVE-2026-16442/16443) affecting link-only account restrictions and signature validation on broker metadata import.

• Upgrade path: 26.7.0 → 26.7.1 (also bundles a Quarkus 3.33.2.1 bump)

Node.js: 11-CVE security release across three LTS lines

The July 2026 Node.js security release — v26.5.1 Current, v24.18.1 "Krypton" LTS, and v22.23.2 — fixes eleven CVEs. High-severity: CVE-2026-56846 (HTTP/2 maxSessionMemory bypass), CVE-2026-56848 (HTTP/2 use-after-free), and CVE-2026-58043 (Permission Model over-grants filesystem access beyond the configured allowlist — a meaningful gap if you rely on --permission for sandboxing). Medium-severity issues touch HTTPS agent/mTLS session reuse, node:sqlite iterator replay, and DNS resolution abort handling. CVE-2026-58044, an HTTP parser header-truncation bug, can enable request smuggling behind certain reverse proxies.

• node --version # verify you are past 26.5.1 / 24.18.1 / 22.23.2 for your line

Nuxt 4.5.1 / 3.21.10: critical DevTools and SSR flaws

The most severe issue in this cycle's web-framework layer: Nuxt's DevTools RPC endpoint accepted unauthenticated requests, allowing arbitrary command execution on the developer's machine (GHSA-279x-mwfv-vcqv, Critical). A second bug, GHSA-9473-5f9j-94wq (High), enabled server-side RCE via runtime template injection in server island props. A third, GHSA-wm8w-6qjm-cv43, let the SSR payload cache leak one user's response to another unauthenticated client. All three — plus two DoS/OOM issues and a low-severity dev-server info leak — are fixed in Nuxt 4.5.1 / 3.21.10. Upgrade with npx nuxt upgrade --dedupe.

PostgreSQL: 11 CVEs across five supported major versions

PostgreSQL's 18.4 / 17.10 / 16.14 / 15.18 / 14.23 release fixes 11 CVEs. Three sit at CVSS 8.8: CVE-2026-6473 (integer wraparound that undersizes a server memory allocation), CVE-2026-6475 (pg_basebackup/pg_rewind following symlinks to overwrite arbitrary files), and CVE-2026-6477 (a stack buffer overwrite reachable through libpq large-object functions). CVE-2026-6637, in the refint contrib module, combines a stack buffer overflow with SQL injection. This release also carries over 60 non-security bugfixes — treat it as a required upgrade, not an optional one, given the file-overwrite and buffer-overflow classes involved.

Other Security Fixes Worth Your Attention

• Docker Desktop: CVE-2026-8936 (uncontrolled recursion in the grpcfuse kernel module causing VM panic on deeply nested bind-mount directories, fixed in 4.76.0) and CVE-2026-6406 (--use-api-socket bypasses Enhanced Container Isolation via HostConfig.Mounts instead of HostConfig.Binds, enabling local privilege escalation).
• Django: 6.0.8 / 5.2.17 fix CVE-2026-15307 (High — spatial-lookup file-write/SSRF via GDAL raster drivers, admin-exploitable) plus three moderate/low XSS and DoS issues.
• Hono: v4.12.34 fixes a JSX memo() cross-request data disclosure (cached renders could leak request-scoped CSRF tokens across users), plus ReDoS in hono/cors and quadratic-complexity DoS in hono/language.
• Auth.js / next-auth: v4.24.15 and @auth/core 0.41.3 fix a homoglyph email-normalization bypass, a getToken() crash on malformed Bearer headers, and OAuth state/nonce/PKCE cookies that weren't bound to the originating provider (cross-provider callback confusion).
• RabbitMQ: earlier 4.x releases fixed CVE-2026-57219 (CVSS 8.7, unauthenticated OAuth-secret disclosure via an obsolete management endpoint) and CVE-2026-57221 (unauthorized queue/exchange enumeration).
• Temporal: server v1.31.2 fixes CVE-2026-5724, where the frontend gRPC streaming interceptor chain skipped authorization on AdminService/StreamWorkflowReplicationMessages, letting a network-adjacent attacker read replication data unauthenticated. Temporal Cloud was not affected.
• Apache Kafka: CVE-2026-41115 (moderate) — the CONSUMER_GROUP_DESCRIBE API validated DESCRIBE instead of READ permission on the GROUP resource, which can misconfigure ACLs; review group ACLs after upgrading past 4.0.0.
• Better Auth: v1.6.26 updated its bundled XML parser to resolve unspecified security alerts and fixed SSO OIDC callback URL encoding.

Containers, Edge & Infrastructure

Docker

Docker Engine 29.7.2 (Aug 5) is a bug-fix pass: fixed panics in docker service create/update on duplicate env vars, image-pull failures for absolute hardlink targets, and docker cp failures on older kernels; BuildKit bumped to v0.32.2. The 29.x line made containerd the default image store, and docker sbom is now deprecated in favor of docker scout sbom. See the security patches above for the two Docker Desktop CVEs fixed in 4.76.0.

Cloudflare

Pages now automatically skips a superseded queued build when a newer one exists for the same project/branch/target (Aug 11). Workers AI and AI Gateway unified model access and billing on Aug 7, so prepaid AI Gateway credits now cover Workers AI inference. Vectorize indexes doubled capacity to 20 million vectors without index-splitting, and a new @cloudflare/ci package auto build-and-deploys Workers repos on every push.

Vercel

The Aug 12 changelog adds DeepSeek V4 Pro and Grok 4.6 to AI Gateway, plus Exa web search as a gateway tool and one-command CLI wiring for Claude Code/Codex/OpenCode. Vercel Connect reached GA for Enterprise Managed Users with 100+ preset connectors. On the framework side, Next.js 16.3 hit LTS on Aug 6 — see the meta-frameworks section below.

Kubernetes & Podman

No Kubernetes release shipped this week; v1.37 is scheduled for Aug 26 with deprecation warnings for kube-proxy IPVS mode and removal of ConfigMap/Secret refs in static pods, while v1.34 enters maintenance mode Aug 27. Podman v6.1.0 adds podman volume rename, podman machine restart, Quadlet ImageVolume= support, and rootless IPv6 port forwarding.

Cloud Platforms

Railway shipped Cloud Agents (beta) and automatic CVE patching for Postgres databases on Aug 7. Render moved its build infrastructure to faster CPU/disk nodes, cutting median build time roughly 40% (Aug 7). AWS added configurable Kubernetes control-plane parameters to Amazon EKS — including scheduler strategy and event retention.

Identity & Authentication

Beyond the Keycloak and Auth.js advisories above: Clerk shipped billing discounts/promo codes (Aug 10) and OAuth Client ID Metadata Documents in beta (Aug 6), plus a sign-in-or-up flow fix that closes an account-enumeration side channel. Auth0 opened early access to Session Delegation via Custom Token Exchange — support-agent impersonation with sub/act claim separation and short-lived, IP-bindable tokens. Better Auth 1.6.27 fixed duplicate session requests across React Suspense retries. Authentik 2026.8.0-rc7 adds a constant-time comparison fix in SecretKeyFilter to harden against timing attacks on secret-key lookups.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js 16.3.0 reached LTS on Aug 6: Node.js streams are on by default, the Turbopack filesystem cache is enabled by default, Partial Prefetching and Cached Navigations are on by default with cache components, and the Edge runtime is deprecated in favor of a self-contained runtime. React 19.2.8 is a minor patch improving React Server Components decoding performance.

Nuxt & Vue

Beyond the critical security release covered above, Nuxt 4.5.2 is the current patch, and Nuxt 3 reached end-of-life with 3.21.11. Vue's 3.6.0-rc.3 introduces opt-in Vapor Mode — non-VDOM compilation aiming for bundle size and performance competitive with Solid and Svelte 5 — built on a reactivity-system refactor using alien-signals.

SvelteKit, Svelte & Astro

SvelteKit's 3.0.0-next.22 continues the 3.0 API reorganization, relocating remote-function types and RequestEvent/Cookies to new module paths. Svelte 5.56.9 is a routine patch. Astro 7.2.1 fixes CSS HMR, CSP violations during prerendering, and middleware HMR; the companion @astrojs/node 11.1.1 fixes an EventEmitter memory leak on static pages with keep-alive and CSP enabled.

Backend Frameworks & Runtimes

NestJS 11.1.29 fixed import-lookup behavior and Redis pub/sub client typing. Fastify shipped its first 6.0.0-alpha.0, removing deprecated types and compatibility shims as a breaking change, while 5.11.3 remains the stable patch line. Hono's feature release, 4.13.0, added roughly 1.25x faster routing and HTTP QUERY method support — see the security section above for its 4.12.34 patch. FastAPI's most recent release, 0.141.1, fixed background-task header handling. Django 6.1 landed as a new feature release the day after its security patch. Laravel 13.25.0 / 12.66.0 added a foreignUlidFor schema helper, a UniqueJobSkipped event, and cloud-agent HTTP client isolation.

UI Systems, Styling & Motion

shadcn/ui added a "Human in the Loop" helper for pausing AI SDK flows on user approval, plus a new Questionnaire component across Base UI, React Aria, and Radix variants. Radix UI 1.6.7 fixed Dialog ARIA references and Slider onValueCommit firing during multi-thumb drags. Tailwind CSS 4.3.3 added --watch --poll[=ms] to the CLI and fixed CSS-nesting and fractional-opacity edge cases. MUI 9.3.1 fixed exit transitions getting stuck. Motion 13.1.0 added multidimensional reorder support and RTL to the Reorder component — note that 13.0.0 made a breaking change, removing the implicit @emotion/is-prop-valid dependency in favor of explicit <MotionConfig isValidProp={isPropValid}> configuration.

Databases, Caching & Vector Search

Beyond the PostgreSQL and MongoDB security releases above: pgvector 0.8.6 fixed a buffer overflow in IVFFlat index builds on 32-bit systems. Redis 8.10.0 (GA, feature line) adds compact hashes for lower memory use and new list-movement commands (LMOVEM/BLMOVEM). ClickHouse tagged v26.7.3.19-stable, v26.6.2.160-stable, and v26.3.17.110-lts this week. DuckDB 1.5.5 fixed out-of-bounds read vulnerabilities and a deadlock in memory management across roughly 80 merged PRs.

Database Tools, ORMs & BaaS

Prisma 8 remains in RC (v8.0.0-rc.1-dev.42) and now supports authoring expression, partial, and unique indexes directly in Prisma Schema Language. Drizzle ORM's latest tag, v1.0.0-rc.4, added Turso serverless and Effect SQL driver support and a Drizzle Kit MCP server for AI-agent integration. Supabase self-hosted/v0.8.0 makes Envoy the default API gateway, replacing Kong — a breaking change for self-hosted deployments only; Supabase Cloud is unaffected. Firebase CLI 15.26.0 adds automatic non-interactive mode when it detects an AI agent driving the CLI, preventing hangs.

Background Jobs, Messaging & Task Queues

BullMQ 6.1.0 adds explicit schema migrations for its new PostgreSQL queue backend, part of the multi-backend IQueueBackend abstraction introduced in 6.0. RabbitMQ 4.3.4 fixed quorum queues losing metrics across upgrade chains and removed unsafe-eval/unsafe-inline from the management UI's CSP headers — see the security section for its two recently patched CVEs. Apache Kafka's latest stable, 4.3.1, fixed a Kafka Streams RocksDB native memory leak. Temporal announced Serverless Workers for AWS Lambda and a Cloud Run pre-release on top of the v1.31.2 security fix covered above.

What to Patch Today

If you only act on five things from this audit, make it these: upgrade MongoDB past 8.0.29/8.3.8/7.0.40, Redis to 8.8.1+, Keycloak to 26.7.1, Node.js to 26.5.1/24.18.1/22.23.2, and Nuxt to 4.5.1+/3.21.10+. Each closes a vulnerability class — unauthenticated RCE, credential exposure, or SSRF — that's realistically reachable in a default deployment. Everything else in this digest is worth a look on your next sprint planning pass, but these five are worth an emergency change ticket.