Dev Stack Release Audit — August 14, 2026: PostgreSQL Patches 28 CVEs, MongoDB ODBC Driver Hits Critical 9.8

Today's audit sweeps releases, changelogs, and security advisories across roughly thirty-five tools spanning containers, identity, meta-frameworks, backend runtimes, UI systems, databases, and messaging infrastructure. The headline is a fresh critical: MongoDB's BI Connector ODBC Driver picked up a CVSS 9.8 buffer overflow, and PostgreSQL closed out a 28-CVE maintenance cycle that skipped 18.5 entirely after a regression. Docker Desktop, Hono, Django, and a wave of framework patch releases round out a busy Friday across the stack.

Executive Summary

• MongoDB BI Connector ODBC Driver shipped five new CVEs, led by CVE-2026-19001 (CVSS 9.8 Critical) — a buffer overflow via oversized catalog, schema, or object names. Upgrade the driver, not the server.
• PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24, plus 19 Beta 3, fixed 28 CVEs and 110+ bugs — and skipped 18.5 entirely after it regressed.
• Docker Desktop 4.86.0 patched CVE-2026-17106, a destination-escape flaw in `docker container cp`.
• Hono quietly shipped a 4-CVE security release in v4.12.34 on Aug 3 that hadn't surfaced in prior audits, covering SSR data disclosure and a CORS ReDoS.
• Auth0's Flexible Password Policy went GA and Better Auth v1.6.28 shipped, both on Aug 13 — the busiest day of the week for identity vendors.
• Cloudflare made Certificate Transparency Monitoring generally available and rolled out new package-registry supply-chain protection for npm, PyPI, Cargo, Go, and Maven traffic.
• Django 6.1 landed as a full feature release with model "fetch modes" to solve N+1 queries, new DB-level `on_delete` options, and several breaking changes.
• Fastify 5.12.0 went stable the same day its first v6.0.0-alpha.1 breaking-change preview shipped.
• BullMQ v6.1.1 released today, fixing parent-option inheritance in flows.
• Supabase CLI 2.114.0 and Firebase CLI 15.27.0 both reached GA/stable this week with new App Check and MCP-related tooling.

Critical Security Patches You Should Not Delay

MongoDB BI Connector ODBC Driver: critical buffer overflow (CVSS 9.8)

Five CVEs were published August 12, 2026 against the MongoDB BI Connector's ODBC Driver — a client-side component, not the MongoDB server itself (which remains on 8.3.8, unchanged since Aug 11). The worst, CVE-2026-19001, is a buffer overflow triggered by oversized catalog, schema, or object names, rated CVSS 9.8 Critical. Related issues include CVE-2026-19002 (memory corruption via metadata parsing, CVSS 8.8), CVE-2026-19003 (buffer overflow from oversized file-path settings, CVSS 8.4), CVE-2026-19004 (memory-safety issue in stored procedures, CVSS 8.8), and CVE-2026-19503 (insufficient OIDC endpoint validation in Schema Builder/SQL ODBC, CVSS 6.3).

• Affected: ODBC Driver before 1.4.9; Schema Builder before 1.2.1; SQL ODBC before 2.0.9 (OIDC issue only)
• Fix: upgrade the BI Connector ODBC Driver package — this does not require a server upgrade. See the MongoDB Security Alerts page.

PostgreSQL: 28 CVEs, and a version that never shipped

PostgreSQL released 18.6, 17.11, 16.15, 15.19, 14.24, and 19 Beta 3 on August 13, 2026 — a larger cycle than usual, fixing 28 CVEs (including CVE-2026-6464, CVE-2026-6469 through 6471, the CVE-2026-14662–14681 cluster, CVE-2026-15741/15742, CVE-2026-16238/16239/16241, and CVE-2026-18024/18408/19385) alongside 110+ non-security bugs. Notably, 18.5 was skipped entirely — the project jumped straight from 18.4 to 18.6 after 18.5 introduced a regression during testing.

• Affected: all supported branches prior to this release
• Fix: upgrade directly to the listed point releases. Post-update steps are required for parallel GIN index builds, `btree_gist`, and `ltree` — read the release announcement before running `REINDEX`.

Docker Desktop 4.86.0: path escape in `docker container cp`

Docker Desktop 4.86.0, released August 10, 2026, fixes CVE-2026-17106, a destination-escape vulnerability in `docker container cp` that could let a crafted copy target write outside the intended host directory. The release also ships Docker VMM Beta performance improvements and clearer Gordon AI error messages for policy-blocked actions and tool failures.

• Affected: Docker Desktop versions prior to 4.86.0
• Fix: update Docker Desktop via the in-app updater or the release notes page.

Hono: a 4-CVE release that slipped through the cracks

Hono's security release, v4.12.34 (Aug 3, 2026), fixed four CVEs that hadn't been flagged in prior audits: CVE-2026-71850 (SSR output cross-user data disclosure via `memo()`, CVSS 4.8 Moderate), CVE-2026-69207 (ReDoS in the CORS middleware via `Access-Control-Request-Headers`, CVSS 5.3 Medium), and CVE-2026-71849/71848 (Proxy helper header leaks). The framework has since moved on to v4.13.2 (Aug 13), a routine bug-fix release with no new CVEs.

• Affected: Hono before 4.12.34
• Fix: upgrade to 4.13.2 or later. Details at GHSA-f23p-vx2j-j53r and the CVE-2026-69207 advisory.

Other Security Fixes Worth Your Attention

• Redis: CVE-2026-66373 (double-free in `RESTORE` via `XGROUP DELCONSUMER`, CVSS 7.5 High) was published July 24 as a follow-up to CVE-2026-25589 — it's already resolved by the 8.8.1 patch covered in yesterday's audit, so no further action is needed if you patched then.
• Podman v6.1.0 (Aug 12) ships no new CVE fixes of its own; the most recent Podman advisory, CVE-2026-19730, was already resolved in v5.8.6.
• Supabase Auth: GHSA-v36f-qvww-8w8m (CVE-2026-31813, CVSS 4.8 Medium — an OIDC issuer-validation bypass affecting Apple/Azure sign-in) was disclosed back in March and fixed in `supabase/auth` v2.185.0; it's listed here only as a reminder for anyone who hasn't rotated onto a patched Auth version yet.

Containers, Edge & Infrastructure

Docker

Beyond the Desktop security fix above, Docker Engine 29.7.2 (Aug 5) patches `docker service create/update` crashes on duplicate environment variables, an image-pull regression on absolute hardlink targets, and older-kernel pull/`cp` failures, while bumping BuildKit to v0.32.2. Docker Compose v5.4.0 (Aug 3) introduces a new reconciliation system that models volume recreation and network lifecycle directly in the execution plan, plus fixes for zero-replica services. See the Engine release notes and Compose releases.

Cloudflare

Cloudflare's changelog picked up pace this week: Certificate Transparency Monitoring reached general availability on all plans (Aug 13), and a new package registry security policy layer landed the same day, giving Gateway customers policy controls over npm, PyPI, Cargo, Go, and Maven traffic. Aug 12 brought content-based email blocking rules for Email Security (Enterprise) and FIDO2 keys for infrastructure SSH under Access.

Vercel

Vercel's Aug 13 changelog batch centers on AI tooling rather than hosting internals: a one-click dashboard flow to upgrade deprecated Node.js versions, Grok Build added to the AI SDK harness layer alongside a new `@ai-sdk/harness-acp` package for ACP-compatible harnesses, and GLM 5.2 running free for Eve agents through Aug 27. No new Next.js hosting or Edge Functions runtime changes were logged this cycle.

Kubernetes & Podman

Podman v6.1.0 (Aug 12) adds `podman volume rename`, `podman machine restart`, an `--ignore` flag on `podman network rm`, retry options on `podman manifest push`, and Quadlet `ImageVolume=` support — see the release notes. Kubernetes remains on v1.36.3 (July 22) as the latest stable patch; v1.37.0 is on track for Aug 26, with its first release candidate already out.

Cloud Platforms

AWS shipped several developer-facing items this window: advanced EKS control-plane configuration parameters (Aug 12), an automated IAM role manager (Aug 12), and Billing and Cost Management Managed Dashboards (Aug 14). Railway's latest changelog entry (Aug 7) covers Cloud Agents beta and automatic Postgres CVE patching; Render's most recent update (also Aug 7) cut median build times roughly 40% with faster CPU/disk build nodes, with no new entries logged since.

Identity & Authentication

Two vendors moved on Aug 13: Auth0's Flexible Password Policy reached general availability, replacing legacy password rules with a NIST-aligned `options.password_options` configuration (composition, history, dictionary-blocking, 15-character minimum) — legacy policies remain supported, but the Management API now rejects requests that mix legacy and new fields. Better Auth v1.6.28 shipped the same day, fixing duplicate session requests during React Suspense retries and restoring TypeScript compatibility for client-plugin declarations. Clerk added discounts and promo codes to its Billing API (Aug 10) and shipped OAuth Client ID Metadata Documents in beta (Aug 6) for MCP-style public OAuth clients. Keycloak remains on 26.7.1, its 12-CVE security release covered in yesterday's audit, with nothing newer as of today. Authentik's latest stable is 2026.5.6, a maintenance release, while 2026.8.0 continues release-candidate testing (rc7, Aug 10). Auth.js/NextAuth shipped a coordinated four-vulnerability fix in late July across v4 (4.24.15), v5 beta (5.0.0-beta.32), and `@auth/core` (0.41.3) — worth noting the project has effectively folded into Better Auth's organization, with new advisories now published on better-auth.com.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js 16.3.1 (Aug 13) remains the latest stable, fixing yesterday's stale-`headers()` regression in `generateMetadata`; a `16.3.1-canary.16` build followed hours later with Turbopack async-module and dev-server tree-shaking fixes, but no new stable cut. React 19.2.8 (July 21) is still current — no August stable releases — though `19.3.0-canary` builds tagged Aug 13 signal active work toward the next minor.

Nuxt & Vue

Nuxt v4.5.2 (Aug 5) is a non-security follow-up to the 4.5.1 patch already covered, improving build-cache performance and fixing client-manifest path resolution and island payload serialization; the parallel v3.21.11 patch confirms Nuxt 3 is now end-of-life as of July 31. Vue.js is stabilizing 3.6 via v3.6.0-rc.3 (Aug 11), with Vapor Mode now feature-complete and benchmarked at parity with Solid and Svelte 5; the stable 3.5 line's latest patch is v3.5.41 (Aug 5).

SvelteKit, Svelte & Astro

SvelteKit continues shipping its 3.0 prerelease incrementally — `3.0.0-next.23` (Aug 13) is a minor prerender-logging fix, landing on top of the remote-function-import relocation already covered. Svelte 5.56.9 (Aug 12) patches `each`-block behavior during pending batches and CSS-comment preservation in the printer. Astro 7.2.2 (Aug 13) ships eight fixes, including stale component styles under dev fallback, dropped optimized images on cached incremental builds, and intermittent `ImageNotFound` errors resolved via concurrent-read limiting with retry/backoff.

Backend Frameworks & Runtimes

Node.js moved to v26.7.0 (Current, Aug 5) with Perfetto tracing support and `Symbol.dispose` in ModuleHooks, and v24.19.0 (LTS, Aug 3) — no new vulnerability post since the July 29 security releases. NestJS v11.1.29 (Aug 10) is an 11-fix patch release with no breaking changes. Fastify v5.12.0 (Aug 13) adds `Reply.prototype.mediaType` and removes raw response headers, shipping alongside the framework's first v6.0.0-alpha.1 breaking-change preview the same day. Express hasn't moved since a May patch (v4.22.2) restoring `req.query` array-parsing depth. ElysiaJS remains on v1.4.29 (June) while v2 ("Kiana") work continues in beta/experimental prereleases. FastAPI v0.141.1 (July 29) is unchanged this week. On the Python/PHP side, Django 6.1 (Aug 5) is the standout: model "fetch modes" solve common N+1 query patterns, new DB-level `on_delete` options (`DB_CASCADE`, `DB_SET_NULL`, `DB_SET_DEFAULT`) push cascade logic into the database, and PBKDF2 iterations rise from 1.2M to 1.5M — but `first()`/`last()` no longer auto-order by primary key, and support for PostgreSQL below 15, MySQL below 8.4, and SQLite below 3.37 is dropped. Laravel v13.25.0 (Aug 11) adds a `foreignUlidFor` migration helper, a `UniqueJobSkipped` queue event, and a global queue-pause switch.

UI Systems, Styling & Motion

shadcn/ui CLI v4.18.0 (Aug 13) merges registry configuration from `package.json` and `components.json`, and fixes `EACCES` crashes when the CLI encounters unreadable directories. Radix UI's `[email protected]` (July 24) reverts a change that had broken React Server Components compatibility. Tailwind CSS v4.3.3 (July 16) is a 13-bug fix-only release, including case-insensitive arbitrary hex color matching and a `--watch --poll` mode for unreliable filesystems. Material UI v9.3.1 (Aug 6) fixes stuck exit transitions and bundles codemod transforms into the published package. Motion v13.1.0 (Aug 10) adds multidimensional `Reorder` support with automatic axis detection and RTL support.

Databases, Caching & Vector Search

PostgreSQL and MongoDB's headline security items are covered above. Elsewhere, Redis 8.10.0 reached general availability (July 29) with compact hash encoding, new commands (`LMOVEM`, `BLMOVEM`, `SUNIONCARD`, `SDIFFCARD`, `BACKUP`), and TLS peer-certificate-based server-to-server auth. pgvector v0.8.6 (July 29) fixes a 32-bit buffer overflow in IVFFlat index builds and tightens `sparsevec` conversion limits. ClickHouse v26.7.3.19-stable (Aug 6) and refreshed LTS builds shipped with no new CVEs against ClickHouse core. DuckDB v1.5.5 "Variegata" (July 22) fixes out-of-bounds reads, a `TemporaryMemoryManager` deadlock, and metadata corruption on `DROP COLUMN`, with v2.0.0 targeted for fall 2026.

Database Tools, ORMs & BaaS

Prisma is mid-transition: the latest stable npm release is `7.9.1` (July 27), while a `v8.0.0-rc.1` GitHub tag (Aug 7) previews breaking changes to aggregate codecs and the `SqlQueryable` driver interface — it isn't yet installable via npm. Drizzle ORM's latest tagged release is `v1.0.0-rc.4` (June 27), adding MySQL codec support and a Drizzle Kit MCP server for AI agents, with `rc.5` prereleases actively landing on npm as of Aug 12. Supabase shipped its August Developer Update (`v1.26.08`, Aug 7) with Supabase Pipelines in public alpha and "Sign in with ChatGPT" in beta, plus Supabase CLI v2.114.0 reaching GA (Aug 12) with a `--project-ref` flag and a Go-to-TypeScript migration for several `db`/`functions` subcommands. Firebase CLI v15.27.0 (Aug 13) adds `appcheck:providers` and `appcheck:apps` commands and custom header forwarding for remote MCP tools.

Background Jobs, Messaging & Task Queues

BullMQ v6.1.1 shipped today, fixing parent-option inheritance in flows; it follows v6.1.0 (Aug 12), which made PostgreSQL backend schema migrations explicit under the newer `IQueueBackend` abstraction. RabbitMQ 4.3.4 (July 23) fixes quorum-queue metrics that stopped emitting after multi-version cluster upgrades and hardens management-UI CSP headers. Apache Kafka 4.3.1 (June 25) remains current, its standout fix a Kafka Streams RocksDB native memory leak — 4.4.0 isn't expected until September. Temporal v1.31.2 (July 8) is unchanged since yesterday's audit, still the fix for CVE-2026-5724 in the replication streaming endpoint.

What to Patch Today

• Upgrade the MongoDB BI Connector ODBC Driver to 1.4.9+ if you use it — CVSS 9.8 is not a "get to it next sprint" severity.
• Run PostgreSQL's point-release upgrade (18.6 / 17.11 / 16.15 / 15.19 / 14.24) and follow the post-update `REINDEX` guidance for GIN, `btree_gist`, and `ltree`.
• Update Docker Desktop to 4.86.0 for the `docker cp` path-escape fix.
• If you're on Hono below 4.12.34, jump straight to 4.13.2 to pick up both the security fixes and subsequent bug fixes.
• Everything else this cycle — Fastify, Django 6.1, Laravel, Nuxt, Astro, BullMQ — is feature and bug-fix work; schedule normally, but budget extra review time for Django 6.1's breaking changes if you're upgrading a production app.