September 2026 Dev Stack Release Roundup: Keycloak, Fastify, Hono, and Podman Ship Security Patches as React 19.3 Debuts View Transitions

Executive Summary

The two weeks leading up to September 18, 2026 delivered a heavy security-patch cycle across identity and backend tooling, alongside notable feature drops in the React/Next.js ecosystem. Highlights:

• Keycloak 26.7.4 (Sept 16) fixes six CVEs, including an impersonation-role privilege escalation and a username-takeover bug — teams running self-hosted Keycloak should patch immediately. See the release announcement.
• Fastify 5.12.5 (Sept 16) patches CVE-2026-92081, a crash-the-server DoS triggered by a single HTTP/2 request using reply.trailer().
• Hono 4.13.7 (Sept 4) fixes an XSS in hono/jsx affecting Suspense, ErrorBoundary, and Context.Provider fallbacks.
• Podman 6.1.2 (Sept 16) closes a file-overwrite flaw in podman load and podman volume import (CVE-2025-11395) — see the release notes.
• Auth0/Okta disclosed a batch of AD/LDAP Connector vulnerabilities on Sept 8, including a CVSS 9.0 stored XSS; details on Okta's security advisories page.
• React 19.3.0 (Sept 9) ships the new <ViewTransition /> component and addTransitionType API — see the release notes. Motion 13.4.0 (Sept 16) already builds on it with a new AnimateView component.
• Cloudflare Workers rolled out granular per-Worker permissions (Sept 15) and raised the bundle-size ceiling to 64 MiB on all plans (Sept 4).
• PostgreSQL, Redis, and MongoDB all shipped security-relevant fixes this cycle (PostgreSQL's Aug 13 release patched 28 CVEs; MongoDB 8.3.9+ closes an unauthenticated full-compromise bug, CVE-2026-82067).
• Astro 7.3.3, Laravel 13.32.0, NestJS 12.0.3/11.2.5, and Node.js 26.9.0 all landed patch or feature releases in the Sept 14–17 window.

Containers, Edge & Infrastructure

Docker

Docker Compose v5.5.1 (Sept 3) bumped compose-go to v2.15.0, added lifecycle-hook output capture and OTel shutdown-error visibility under --debug, and fixed watch-mode syncing into symlinked directories. See the Compose release notes. Docker Desktop's latest notes cover fixes for stuck-socket startup failures and an updated Kind cloud-provider image addressing CVE-2026-46595 and CVE-2026-39834 — check the release notes and security announcements directly, since the exact current Desktop build number varies by channel.

Cloudflare

Cloudflare shipped Granular Worker Permissions on Sept 15 — four new roles (Metadata Read-Only, Content Read-Only, Editor, Admin) scopable per-Worker or platform-wide and cascading to Durable Objects. Workers also gained Python 3.14 support (Sept 8) and a bundle-size ceiling raised to a flat 64 MiB uncompressed on all plans (Sept 4). On the storage side, R2 Data Access Logs went GA on Sept 4.

Vercel

Vercel's changelog shows Secure Compute / Static IP builds getting ~64% faster via prewarmed build containers (Sept 16), a Skills CLI that can install agent skills from a Notion database without a Git repo (Sept 17), and AWS PrivateLink reaching GA for private connections from Vercel deployments to AWS-hosted databases.

Kubernetes & Podman

Kubernetes' latest stable minor remains v1.37.0 (Aug 26), with 1.34 entering maintenance mode on Aug 27 ahead of an Oct 27 EOL — no new CVE was confirmed as freshly published in the Sept 1–18 window. Podman 6.1.2 (Sept 16), by contrast, is a dedicated security release: it fixes CVE-2025-11395, where crafted layer tarballs via podman load or malicious symlinks via podman volume import could overwrite host files, plus two lower-severity issues the maintainers say aren't exploitable via the Podman CLI itself.

Cloud Platforms

AWS announced the Amazon Linux 2027 public preview in September, built on kernel 7.1+ with SELinux enforcing by default and AWS-LC crypto acceleration. Railway's changelog lists one-click Postgres major-version upgrades and email forwarding for Railway domains (Sept 11), while Render's changelog adds Blueprint (IaC) support for Workflow services (Sept 16) and a redesigned Deploys page (Sept 3).

Identity & Authentication (IAM)

Keycloak

Keycloak 26.7.4 (Sept 16) is a security release fixing six CVEs: a MySQL/MariaDB replay-gate bypass, an unauthenticated DoS via locale caching, a path/matrix-parameter authorization bypass, a username-takeover bug, a privilege escalation via the impersonation role, and a SAML redirect information disclosure. Full details are in the official announcement. Two additional unpatched issues are circulating as of early September — a device-flow token issuance bug for locked accounts and a weakly-bound first-broker-login identity check — so watch the release page for the next patch.

# Pull the patched image and roll it out
docker pull quay.io/keycloak/keycloak:26.7.4
kc.sh start --optimized

Authentik

Authentik 2026.8.3 (Sept 17) fixes an LDAP memory leak, OAuth token-exchange issues, and websocket proxy behavior. Backport releases 2026.5.7 and 2026.2.7 (Sept 9) carried security patches for group-hierarchy roles and moved to constant-time secret-key comparisons. See the release notes.

Clerk & Auth0

Clerk added OAuth Device Authorization Grant (RFC 8628) support on Sept 8, letting CLIs, TVs, and consoles authenticate via a browser-capable companion device. Auth0/Okta disclosed a set of AD/LDAP Connector vulnerabilities on Sept 8: a CVSS 9.0 stored XSS in the connector admin panel, a local privilege-escalation bug via config tampering, and unauthenticated localhost admin-panel access — fixed in ad-ldap-connector v8.0.0+. Review Okta's advisories if you run an on-prem AD/LDAP bridge.

Better Auth & Auth.js

Better Auth moved fast this cycle: v1.7.5 (Sept 14) adds Postgres schema-name support for direct connections and better Cloudflare Turnstile verification logging, while v1.7.3 (Sept 6) added Cloudflare as a built-in social provider and turned on schema validation by default in production. Auth.js (NextAuth) remains in maintenance mode under Better Auth's stewardship, with its last security update (four advisories, including an email homoglyph validation bypass) shipped July 21 in next-auth 4.24.15 and @auth/core 0.41.3 — see the release history.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js v16.3.5 (Sept 11, release notes) is a backport-only patch: it fixes the disk LRU cache for next/image, corrects whole-app NFT emission for output: 'standalone' with adapters, and adds a CSP nonce to script tags on loading/template files — no breaking changes. React 19.3.0 (Sept 9, release notes) introduces the <ViewTransition /> component and addTransitionType API to drive native View Transition animations, allows refs on <Fragment />, and lets independent transitions render without blocking each other.

import { ViewTransition, addTransitionType } from 'react';

function Page() {
  return (
    <ViewTransition name="card">
      <Card />
    </ViewTransition>
  );
}

Nuxt & Vue.js

Nuxt's core package hasn't shipped a new stable minor since v4.5.0 in July; this window only saw sub-tool releases — @nuxt/test-utils v4.3.0 (Sept 7) added unmockNuxtImport and Vitest 5 support. Vue 3 core also has no new stable release; 3.6 is still in release-candidate territory at 3.6.0-rc.8 (Sept 11) as the team works toward a Vite 8 / Rspack-era stable.

SvelteKit & Svelte

Svelte's September recap highlights v5.57.0 additions like getOrInsert/getOrInsertComputed on SvelteMap and new svelte/server type exports. SvelteKit 3 remains in release-candidate builds (3.0.0-next.17 through next.27) with one notable breaking change: defineParams and its types moved to @sveltejs/kit/params; see the kit releases for the full RC log.

Astro

Astro v7.3.3 (Sept 16) is a patch release improving dev-server performance and fixing image-endpoint handling. Same-day companion releases include @astrojs/netlify 8.2.6 (a skew-protection fix for duplicate framework instances on lazy-hydrated islands) and @astrojs/cloudflare 14.3.2 (wrangler export/build fixes) — see the full release list.

Backend Frameworks & Runtimes

Node.js & NestJS

Node.js v26.9.0 (Sept 16, Current) adds a generic MAC API in node:crypto and enables the FFI module by default; v24.21.0 "Krypton" (LTS) shipped Sept 8 with crypto root-cert updates — see the Node.js releases. NestJS shipped patch releases v12.0.3 and v11.2.5 (Sept 15) fixing Kafka microservice message handling and TCP socket stability, following v12.0.0's ESM migration (CLI rebuilt in ESM, Rspack default bundler) — see the Nest releases.

Fastify & Express

Fastify v5.12.5 (Sept 16) is a security release for CVE-2026-92081 (CVSS 5.9, medium): calling reply.trailer() on an HTTP/2 route set the forbidden Transfer-Encoding: chunked header, throwing an uncaught exception that let a single unauthenticated request crash the server. Express hasn't released in this window; the most recent notable fix remains v4.22.2 (May), and its body-parser dependency was separately bumped to ^2.3.0 for GHSA-v422-hmwv-36x6, where an invalid limit option silently disabled body-size enforcement.

npm install [email protected]

ElysiaJS & Hono

Hono v4.13.7 (Sept 4) fixes CVE-2026-24771 / GHSA-9r54-q6cx-xmh5: hono/jsx failed to HTML-escape plain strings passed as children of Suspense, ErrorBoundary, and Context.Provider, or as the root value to renderToString() — enabling XSS with untrusted input. Any app rendering user content through those APIs should upgrade immediately. ElysiaJS's v1.4.30 (Aug 26) is a security-only maintenance release, with active development now focused on Elysia 2.0; see the Elysia releases.

FastAPI & Django

FastAPI's most recent notable release is v0.141.1 (July), which added easier local dev via app.frontend(check_dir="auto"). Django's Aug 4 security release (6.0.8 / 5.2.17) remains the current baseline, fixing CVE-2026-15307 (High — spatial lookups could enable RCE/SSRF via GDALRaster), CVE-2026-15830 (segfaults from deeply nested GEOMETRYCOLLECTION), and CVE-2026-15920 (admin XSS via unvalidated URLField rendering).

Laravel

Laravel v13.32.0 (Sept 15) adds a Mercure broadcast driver and copyToDisk/moveToDisk filesystem methods; v13.31.0 (Sept 8) added a queue totalSize method and once assertions for mail/notification fakes. See the framework releases.

UI Systems, Styling & Motion

shadcn/ui's September update moves every component to import cn from a new standalone package, consolidating what used to be a bundled clsx + tailwind-merge pairing. Radix UI, Tailwind CSS (v4.3.3), and Material UI (v9.4.0, which adds an opt-in theme.focusVisible for a consistent keyboard focus ring) haven't shipped a release in the last two weeks specifically, but Motion has been the most active: v13.4.0 (Sept 16) adds AnimateView, a component for driving View Transitions in React 19.3 on top of React's native ViewTransition, while v13.3.0 (Sept 14) reworked spring retargeting for roughly 80% faster performance and a ~10% smaller bundle.

import { AnimateView } from 'motion/react';

<AnimateView>
  <ProductCard />
</AnimateView>

Databases, Caching & Vector Search

PostgreSQL's Aug 13 release (18.6, 17.11, 16.15, 15.19, 14.24) patched 28 CVEs, several rated 8.1–8.8, including heap buffer overflows in regexp, to_char, and plperl that could enable arbitrary code execution — if you're not already on a patched point release, prioritize it. pgvector's most recent release, v0.8.6 (July), fixed a 32-bit buffer overflow in IVFFlat index construction. Redis Software 7.22.2-189 bundles fixes for several open-source Redis/RedisBloom CVEs, including a use-after-free from evicting a blocked client mid re-execution that could enable RCE. MongoDB 8.3.11 (Sept 17) is bug-fix-only, but the security baseline to be on is 8.3.9+, which closes CVE-2026-82067 — a case-sensitivity handling bug that could leave the authorization subsystem disabled at startup. On the analytics side, ClickHouse 26.8 (LTS) (Sept 1) adds custom HTTP handlers, a new pipe operator (|>) for chained query transformations, and a cost-based optimizer, while DuckDB's latest stable, v1.5.5, remains a July bugfix release ahead of the v2.0 feature freeze.

Database Tools, ORMs & BaaS

Prisma is deep into its v8 release-candidate cycle — v8.0.0-rc.15 (Sept 14) adds a --format markdown CLI output mode for agent tooling, on top of accumulated RC-era breaking changes like the take()/skip() → limit()/offset() pagination rename. Prisma Compute, their managed Postgres platform, reached general availability on Aug 28 with a free tier. Drizzle ORM hasn't cut an official release since v1.0.0-rc.4 in June, though an rc.5 canary is circulating on npm. Supabase's "Observability on Auto-Pilot" update (Sept 13) lets teams hire an agent to watch a project using pre-built monitoring prompts, runnable from Claude, Cursor, or Codex. Firebase's JS SDK v12.19.0 (Sept 9) fixed Auth IndexedDB reconnection on iPadOS/iOS Safari and added Firestore support for Temporal.Instant serialization.

Background Jobs, Messaging & Task Queues

BullMQ v6.3.6 (Sept 14) fixed nested duplicate() calls on the Bun adapter — routine maintenance, no CVEs. RabbitMQ v4.3.6 (Sept 14) stops exchange deletion from leaving orphaned bindings and fixes excessive quorum-queue replica growth during membership reconciliation; it also adds a channel_tx_message_max setting to cap transaction publishes. Apache Kafka hasn't released in this window — the current line is 4.2.1 (May) — but its most significant recent advisory, CVE-2026-35554 (CVSS 8.7), covers a producer buffer-pool race condition that could silently misroute messages to the wrong topic; it's fixed in 4.2.0+. Temporal likewise has no release in this window, but CVE-2026-5724 — a missing authorization interceptor on a replication-streaming endpoint for self-hosted clusters with cross-cluster replication — is fixed in server 1.28.4, 1.29.6, and 1.30.4+.

What to Patch First

If your team only has time for a handful of upgrades this week, prioritize the items with confirmed CVEs and a live patch available:

• Keycloak → 26.7.4 (six CVEs, including privilege escalation)
• Fastify → 5.12.5 (unauthenticated DoS via HTTP/2 trailers)
• Hono → 4.13.7+ (stored XSS via hono/jsx)
• Podman → 6.1.2 (host file overwrite via load/volume import)
• MongoDB → 8.3.9+ / 8.0.30+ / 7.0.41+ (authorization subsystem bypass)
• PostgreSQL → latest 18.x/17.x/16.x/15.x/14.x point release (28 CVEs, several enabling code execution)
• Django → 6.0.8 / 5.2.17 (spatial-lookup RCE/SSRF risk)
• Auth0 AD/LDAP Connector → 8.0.0+ (CVSS 9.0 stored XSS)