Sept 17 2026 Dev Stack Release Audit: Fastify DoS Fix, MongoDB's Critical CVE, and a Wave of Sept 16 Patches

Seventeen tools across the modern web stack shipped patches, security fixes, or new releases in the 24 hours around September 17, 2026. The headline items are a Fastify security release that closes an HTTP/2 crash-denial-of-service bug, and a critical MongoDB CVE that can leave a server's authorization subsystem silently disabled at startup. Below is a verified, source-linked breakdown of what changed and what to do about it, organized by layer of the stack.

Executive Summary

• Fastify 5.12.5 fixes a crash where reply.trailer() over HTTP/2 sets a forbidden header and kills the entire server on a single request (GHSA-4mh8-r7rc-xpvc / CVE-2026-92081) — upgrade immediately if you run HTTP/2.
• MongoDB disclosed CVE-2026-82067 (CVSS 9.2), a config-validation flaw that can leave the authorization subsystem disabled at startup, permitting unauthenticated admin access. Fixed in 8.3.9, 8.0.30, and 7.0.41.
• Podman 5.8.7 patches a host-file-overwrite flaw in podman load/podman volume import (CVE-2025-11395).
• Keycloak 26.7.4 (still rolling out) patches 6 CVEs including unauthenticated DoS and a SAML state-leak — teams that haven't upgraded off 26.7.x should prioritize it.
• Node.js 26.9.0 ships a generic MAC crypto API, OpenSSL provider-based discovery, and FFI enabled by default.
• React 19.3.0 adds a <ViewTransition /> component and decouples slow transitions from unrelated updates.
• NestJS 12.0.3, Laravel 13.32.0, Astro 7.3.3, and Better Auth 1.7.5 all shipped maintenance releases this week.
• RabbitMQ 4.3.6 and Temporal Server 1.32.0 landed reliability fixes; Temporal also closed a medium-severity unauthenticated gRPC replication endpoint (CVE-2026-5724).

Containers, Edge & Infrastructure

Docker

Engine v29.8.1 (Sept 15) is a patch release fixing containerd image-store issues, managed-containerd logging, and OpenVZ user-namespace detection. The prior v29.8.0 (Sept 3) added a --umask container flag and AppArmor profile customization. Compose v5.5.1 bumps compose-go to v2.15.0 and fixes lifecycle-hook output capture.

Security: Docker Sandboxes 0.42.0 (Sept 7) fixed a critical macOS virtio-fs symlink-follow bug (CVE-2026-77179) that let a sandbox overwrite host files, plus a guest-to-host Unix-socket relay issue (CVE-2026-79994). Desktop 4.86.0 separately fixed a path-escape in docker container cp (CVE-2026-17106).

Cloudflare

Workers gained Granular Worker Permissions (Sept 15) — four new roles for scoping teammate/CI/agent access — plus a bump to a 64 MiB uncompressed size limit on all plans. R2 Data Access Logs reached GA, logging every read/write/list/delete across the S3 API, dashboard, and bindings.

Vercel

Vercel Sandbox storage doubled to 64 GB by default (Sept 11), and Pro teams moved to flat-rate CDN pricing (Sept 8). See the Vercel changelog for the full list. The most recent framework-level security release remains the Next.js May 2026 security release, patching React Server Components DoS issues (CVE-2026-23869) and middleware bypass/SSRF/cache-poisoning bugs.

Kubernetes & Podman

v1.37.0 "Garhwal" remains the current minor (67 enhancements). A moderate admission-control bypass, CVE-2026-41178, where kube-apiserver Node updates could skip a Validating Admission Webhook, is being patched across distro packages this week.

Podman v5.8.7 (Sept 16) is a security release fixing CVE-2025-11395, where crafted layer tarballs in podman load or symlinks in podman volume import could overwrite host files outside the target directory.

Cloud Platforms

AWS shipped Fargate proxy-injection automation and 80–93% faster AI model cold-starts on EKS (Sept 1); note App Mesh is being discontinued Sept 30, 2026. Railway added one-click Postgres major-version upgrades (Sept 11). Render (Sept 16) now lets Workflow services be defined via Blueprints as infra-as-code YAML.

Identity & Authentication

Keycloak

v26.7.4 (Sept 16) patches six CVEs: two unauthenticated DoS issues, a percent-encoded-semicolon path-matching bypass, an impersonation-role privilege escalation, a SAML redirect DEFLATE state-leak, and a MySQL/MariaDB replay-protection gap. Quarkus was bumped to 3.33.3.2.

Authentik & Better Auth

Authentik v2026.8.2 (Sept 9) is a stability patch; separately, CVE-2026-72537 (CVSS 8.8) showed a source-scoped SCIM provisioning token could be used to take over any account, including superusers. Better Auth 1.7.5 (Sept 14) adds database.schemaName for direct Postgres connections and fixes Postgres/MySQL migration bugs.

Clerk, Auth0 & Auth.js

Clerk added an OAuth Device Authorization Grant flow (RFC 8628) for CLI/TV sign-in (Sept 8). Auth0 moved Enterprise Connection Events and B2B Connect to Early Access (Sept 16). Auth.js — now maintained by the Better Auth team — closed four advisories in its July 2026 security update, including an email-Unicode homoglyph bypass and OAuth cookies not bound to the issuing provider.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js v16.3.5 (Sept 11) fixes empty-image disk-cache handling and adds a CSP nonce to loading/template scripts. React v19.3.0 (Sept 9) ships the <ViewTransition /> component, addTransitionType, ref support on <Fragment>, and a new browser() API for browser-only subtrees.

Nuxt & Vue

Nuxt's most consequential recent event is the July 27 security release (v4.5.1/v3.21.10), which fixed a cluster of server-island vulnerabilities including a server-side RCE via runtime template injection (CVE-2026-71320) when vue.runtimeCompiler is enabled — worth auditing if you're still on an older 4.5.x/3.21.x build. Vue v3.6.0-rc.8 (Sept 11) is nearing Vapor Mode completion, an opt-in compiler mode that cuts bundle size via reactivity rewritten on alien-signals.

SvelteKit, Svelte & Astro

SvelteKit 3 preview (3.0.0-next.27, Sept 8) removes the Server/SSRManifest exports as part of new adapter hooks. Svelte v5.57.0 adds has() to createContext and new SvelteMap methods. Astro v7.3.3 (Sept 16) fixes image-endpoint status codes, speeds up dev-server startup by ~33%, and bundles a security update to svgo 4.0.2.

Backend Frameworks & Runtimes

Fastify (security release)

v5.12.5 (Sept 16) fixes a crash where calling reply.trailer() over HTTP/2 sets a forbidden Transfer-Encoding: chunked header, throwing an uncaught exception that kills the entire server process on a single crafted request — GHSA-4mh8-r7rc-xpvc / CVE-2026-92081 (CVSS 5.9). Any service using HTTP/2 trailers should upgrade now:

npm install [email protected]

NestJS, Node.js & Express

NestJS v12.0.3 (Sept 15) fixes microservices Kafka hook execution and TCP socket cleanup on shutdown, following the ESM-ready v12.0.0 major. Node.js v26.9.0 (Sept 16, Current) adds a generic MAC crypto API, OpenSSL provider-based cipher discovery, and enables FFI by default. Express v4.22.3 (Sept 14) bumps path-to-regexp to close the ReDoS issue CVE-2026-4867.

ElysiaJS, Hono & Python/PHP stacks

ElysiaJS v1.4.30 (Aug 26) is a security-only release ahead of the Elysia 2 rewrite, closing a multipart-parsing DoS and a cookie prototype-pollution bug. Hono v4.13.8 improves AWS Lambda response-streaming backpressure. FastAPI's underlying Starlette disclosed "BadHost" (CVE-2026-48710, CVSS 6.5, added to CISA's KEV catalog), a missing Host-header validation that can desync routed paths from security checks; fixed in Starlette 1.0.1. Laravel v13.32.0 (Sept 15) adds a Mercure broadcast driver and fixes Redis tagged-cache expiry sync.

UI Systems, Styling & Motion

shadcn/ui shipped a standalone cn package (changelog) as a drop-in replacement for the twMerge(clsx(...)) boilerplate most projects hand-roll — migrate with:

npx shadcn@latest migrate cn

Radix UI Primitives v1.6.7 fixed broken ARIA refs in Dialog and a Slider onValueCommit bug. Tailwind CSS v4.3.3 added --watch --poll[=ms] for flaky filesystems. Material UI v9.4.0 introduced theme.focusVisible for a consistent keyboard focus ring. Motion v13.4.0 shipped Sept 16.

Databases, Caching & Vector Search

PostgreSQL & pgvector

The cumulative patch line (18.6 / 17.11 / 16.15 / 15.19 / 14.24, Aug 13) fixed 28 security vulnerabilities, including CVE-2026-6464 (psql COPY FROM STDIN treated as commands, CVSS 8.1) and CVE-2026-18408 (a \unrestrict code-execution flaw). PG14 reaches end-of-life Nov 12, 2026 — plan the upgrade now. pgvector v0.8.6 fixed an integer-wraparound buffer overflow in IVFFlat index builds (CVE-2026-18022, CVSS 8.8).

Redis & MongoDB

Redis v8.10.1 patches a CMSketch RDB-loading buffer miscalculation and TLS/blocked-client use-after-free bugs. MongoDB disclosed CVE-2026-82067 (CVSS 9.2, Sept 8) — a config-validation flaw that can leave the authorization subsystem disabled at startup, permitting unauthenticated admin access. Patch to 8.3.9, 8.0.30, or 7.0.41 immediately if you're on an affected line:

db.version()  // confirm you're on 8.3.9, 8.0.30, or 7.0.41+

ClickHouse & DuckDB

ClickHouse v26.8 LTS (Sept 1) adds background/pipelined SQL queries and expanded data-lake integration; note max_insert_threads now defaults to auto, a breaking change for tuned insert workloads. DuckDB v1.5.5 is a bugfix release with JSON and Parquet corrections.

Database Tools, ORMs & BaaS

Prisma announced Prisma Compute general availability (Aug 28) with a free tier of 1M requests/month; Prisma 8 remains in RC. Drizzle ORM v1.0.0-rc.4 fixed View/Subquery type issues and added Turso WASM migration support. Supabase shipped AI-agent observability (Sept 13) — note the Management API's logs.all endpoint is being removed Sept 23 in favor of a ClickHouse-backed logs endpoint, requiring a SQL migration. Firebase JS SDK v12.18.0 (Sept 15) adds limited-use App Check tokens for replay protection.

Background Jobs, Messaging & Task Queues

BullMQ v6.3.6 (Sept 14) is a minor fix, but the v6 line's pluggable IQueueBackend (Postgres alongside Redis) removed legacy repeatable-job APIs — a breaking change worth reviewing before upgrading. RabbitMQ v4.3.6 (Sept 14) fixes exchange-deletion cleanup and quorum-queue membership reconciliation; teams still on pre-4.1.11/4.2.6 builds remain exposed to the critical CVE-2026-57211 (CVSS 10, Windows SSRF via the management plugin). Temporal Server v1.32.0 (Sept 11) makes Activity Eager Execution GA-by-default and fixes CVE-2026-5724, a missing-auth gap on the gRPC replication streaming endpoint (Temporal Cloud was unaffected).

What to Prioritize Today

• Upgrade Fastify to 5.12.5 if you serve HTTP/2 traffic — the crash DoS needs no authentication.
• Confirm your MongoDB deployment is on 8.3.9 / 8.0.30 / 7.0.41 or later before CVE-2026-82067 gets weaponized.
• If you're running Podman for CI or local builds, move to 5.8.7 before pulling untrusted images.
• Audit any Nuxt server-island usage with vue.runtimeCompiler enabled against the July 2026 advisory if you haven't already.