Dev Stack Release Audit — August 18, 2026: RabbitMQ's Ten-Advisory Disclosure, Better Auth v1.7.0, and MongoDB's Confirmed CVE Patches

Executive Summary

• RabbitMQ discloses ten security advisories in one day — the most severe, a pre-auth Web STOMP memory-exhaustion bug (GHSA-cfqc-c682-93mm, CVSS 8.2), lets an unauthenticated client crash a node with a handful of connections. Fixed in 4.2.10 and 4.3.5.
• Better Auth ships v1.7.0, a breaking release that closes a session-revocation gap: access tokens now immediately report {active:false} once the parent session ends, instead of staying valid until their own TTL expires. Adds device-code flow, DPoP token binding, and OIDC back-channel logout.
• MongoDB confirms patched versions for the critical intra-cluster auth-downgrade flaw (CVE-2026-18691, CVSS 9.0) reported yesterday: upgrade to 7.0.40, 8.0.29, or 8.3.8.
• Docker's docker cp path-traversal CVE (CVE-2026-17106) continues to propagate through Desktop point releases; confirm you're on Engine/CLI 29.7.0+ or go-archive 0.3.0+.
• DuckDB previews v2.0 "Cyanoptera" with a new client-server protocol, a VARIANT type for semi-structured data, and a 40x recursive-query speedup.
• Prisma v8.0.0-rc.2 unifies the CLI binary and splits the SQL driver interface into query() and execute() calls ahead of Prisma 8 GA.
• shadcn/ui ships a new headless @shadcn/react package with chat-UI primitives (message-scroller, Bubble, Attachment) decoupled from styling.
• Meta-frameworks (Next.js, React, Vue, Svelte, Astro), core backend runtimes (Node.js, NestJS, FastAPI, Django, Laravel), and most infra tooling (Kubernetes, Podman, AWS, Vercel, Railway, Render) had a quiet 48 hours — no new CVEs or notable releases beyond what prior editions already covered.

RabbitMQ: Ten Security Advisories in One Day

On August 18, 2026, RabbitMQ maintainers published roughly ten GitHub Security Advisories simultaneously, spanning the 3.13.x through 4.3.x release lines. Two stand out.

Web STOMP pre-auth memory exhaustion — GHSA-cfqc-c682-93mm, High, CVSS 8.2. WebSocket compression is negotiated before STOMP authentication completes, so an unauthenticated client can send roughly 90KB of compressed traffic that expands to 64MiB per connection. A handful of connections is enough to exhaust memory and crash a node. Fixed in 4.2.10 and 4.3.5.

Administrator RCE via reflected Erlang distribution auth — GHSA-3526-xvv4-q9mr, Moderate, CVSS 5.9. Chaining global-parameter routes, the reset endpoint, and OTP 27's legacy cookie-challenge behavior lets an already-privileged admin account execute arbitrary BEAM functions without knowing the distribution cookie. Fixed in 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

The remaining advisories in the batch cover Shovel URI credential disclosure, a STOMP pre-auth frame-size limit bypass, direct reply-to forged-suffix fanout, and lower-severity issues touching OAuth, MQTT 5.0, federation, and consistent-hash exchanges. If you're running a pre-4.2.10/4.3.5 cluster, patch now:

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install rabbitmq-server=4.3.5-1

# Docker
docker pull rabbitmq:4.3.5-management

Better Auth v1.7.0: Session Revocation, DPoP, and a Breaking Identity Model

Better Auth v1.7.0 landed August 18, 2026, and it's a genuinely breaking release. Account identity is now scoped by verified issuer/subject (OIDC sub, SAML NameID) rather than provider-account-id alone, which requires a manual backfill migration for existing deployments. signIn.oauth2() is renamed to signIn.social() with PKCE on by default, and MCP support has been split into a standalone package.

The security-relevant change: session-bound access tokens now immediately return {active:false} from the introspection endpoint the moment the parent session ends, instead of staying valid until their own TTL expires. That closes a window where a revoked session's tokens kept working. The release also adds RFC 8628 device-code flow, DPoP token binding, private_key_jwt client authentication, and OIDC back-channel logout.

npm install [email protected]

# Session-bound tokens now honor immediate revocation:
# GET /oauth2/introspect -> { "active": false } as soon as the parent session ends

MongoDB CVE-2026-18691: Patched Versions Confirmed

Yesterday's edition flagged MongoDB's critical replica-set intra-cluster auth-downgrade vulnerability (CVE-2026-18691, CVSS 9.0). The fixed versions are now confirmed: 7.0.40, 8.0.29, and 8.3.8. Any deployment on 7.0.x below 7.0.40, 8.0.x below 8.0.29, or 8.3.x below 8.3.8 remains exposed. Until you can upgrade, firewall port 27017 to replica-set members only as an interim mitigation.

Docker: The docker cp Path-Traversal CVE Keeps Propagating

CVE-2026-17106 (GHSA-hfg8-hc9c-6c3h) is a path-traversal flaw in moby/go-archive's tar extraction routines (Unpack, UntarLayer, ApplyLayer). A malicious archive can follow symlinks out of the destination directory during docker cp or image extraction, resulting in arbitrary file write or overwrite on the host. It's fixed in go-archive v0.3.0 and Docker Engine/CLI 29.7.0, and it finished propagating to desktop users via Docker Desktop 4.86.0 this week. Confirm your Engine/CLI version before trusting untrusted archives with docker cp.

DuckDB Previews v2.0 "Cyanoptera"

DuckDB published a v2.0 "Cyanoptera" roadmap post on August 17, summarizing over 10,000 commits since 1.5. Highlights: a new Quack client-server protocol, a CONNECT statement for pushing queries down to remote Postgres/MySQL, a schema-less VARIANT type for semi-structured data, a 40x speedup on recursive queries, a custom PEG SQL parser replacing the Postgres-derived one, a new on-disk storage format, and a broadened stable C API for cross-version extension compatibility. This is a preview, not a release — treat it as a heads-up for extension maintainers rather than something to upgrade to today.

Prisma v8.0.0-rc.2: One CLI Binary, Cleaner Aggregates

Prisma v8.0.0-rc.2 (August 17) retires the separate prisma-next binary in favor of a single unified prisma CLI — config moves from prisma-next.config.ts back to prisma.config.ts. Aggregate results revert to plain JavaScript number by default, with lossless countBigInt() and avgDecimal() variants available when precision matters. The SQL driver interface is now formally split between query() for row streaming and execute() for non-returning writes. If you're tracking Prisma 8, this RC is the checkpoint to test breaking changes against before GA.

shadcn/ui: Headless Chat Primitives

shadcn shipped a new headless package, @shadcn/react, starting with a message-scroller component alongside Message, Bubble, Attachment, and Marker — building blocks for chat interfaces with streaming, thread restoration, and message-jumping logic decoupled from visual styling. It works with both Radix and Base UI primitives underneath.

pnpm dlx shadcn@latest add message-scroller message bubble attachment marker

Quiet Corners of the Stack

Not every category moved today, and that's worth saying plainly rather than manufacturing an angle. Next.js, React, Nuxt, Vue, SvelteKit, Svelte, and Astro had no releases or advisories in this window — the most recent activity (Next.js 16.3.1, Vue 3.6 vapor-mode RC, a Nuxt open-redirect CVE) was already covered in prior editions. Same for the backend runtimes: NestJS, Node.js, Fastify, Express, ElysiaJS, Hono, FastAPI, Django, and Laravel are all sitting on releases from August 11-14 with nothing new since.

Two dates worth putting on a calendar: Kubernetes 1.34 enters maintenance mode on August 27, 2026 (EOL October 27), and Laravel 12's bug-fix window closed August 13, 2026 — it's now security-fixes-only until February 2027. Neither is an emergency, but both affect upgrade planning.

What to Do Today

• If you run RabbitMQ 3.13.x-4.3.x anywhere it's internet-reachable, patch to 4.2.10 or 4.3.5 today — the Web STOMP issue is remotely exploitable pre-authentication.
• Confirm your MongoDB clusters are on 7.0.40, 8.0.29, or 8.3.8; firewall port 27017 in the meantime if you can't upgrade immediately.
• Check Docker Engine/CLI is on 29.7.0+ before running docker cp against archives from untrusted sources.
• If you're on Better Auth, read the v1.7.0 migration notes before upgrading — the issuer/subject identity change needs a manual backfill.