September 2026 Dev Stack Release Audit: MongoDB and Keycloak Patch Auth Bypass Bugs

Today's pull across the stack is dominated by one theme: authentication and authorization keep breaking in exactly the way a test suite should catch, and didn't. MongoDB, Keycloak, and Redis all shipped fixes this week for bugs that let an attacker skip a check they were never supposed to be able to skip. Pair that with a Docker path-escape fix and a Laravel debug-page XSS, and September 20 is a patch-first kind of day for anyone running these in production.

Executive Summary

• MongoDB fixed CVE-2026-82067 (CVSS 8.1): a case-sensitivity bug in config validation that could leave the authorization subsystem disabled at startup, letting an unauthenticated attacker run admin operations. Affects Server versions before 7.0.41, 8.0.30, and 8.3.9.
• Keycloak 26.7.4 closed six CVEs in a single release, including a privilege-escalation bug where an impersonation-scoped role can be used to impersonate a full realm admin.
• Redis confirmed CVE-2026-81934, a use-after-free in TLS pending-data processing that Redis's own team downgraded from an initial CVSS 9.8 to 7.5 after review. Patched all the way back to the 6.2 line.
• Docker Desktop 4.91.0 fixes CVE-2026-17106, a destination-escape flaw in docker container cp that could write files outside the intended target path.
• Laravel disclosed and patched an XSS in the framework's debug page — a reminder that APP_DEBUG=true reaching production is a real, current risk, not a hypothetical one.
• Fastify shipped a security fix (GHSA-4mh8-r7rc-xpvc) in the 6.0.0-alpha.4 pre-release, ahead of the v6 stable line.
• Breaking-change watch: Cloudflare Workers' bundle-size cap jumped from 10MB compressed to a flat 64MiB uncompressed, Prisma ORM 8 is now at release-candidate stage with GA expected in October, and BullMQ's Postgres-backed queue backend keeps shipping fixes as it matures.

Containers, Edge & Infrastructure

Docker

Docker Desktop 4.91.0 (Sept 14) fixes the path-escape flaw in docker container cp described above, and bundles Docker Engine v29.8.0, containerd v2.3.4, and Docker Compose v5.5.1. The release also fixes a corrupt network database that could block the engine from starting, plus disk-image relocation bugs that were deleting images. Update Desktop before you next run cp against anything you don't fully trust.

Cloudflare

Three changes worth adjusting configs for: granular Worker permissions shipped Sept 15 with four new roles (Metadata Read-Only, Content Read-Only, Editor, Admin) for Workers and Durable Objects access; Python Workers now support Python 3.14 on compatibility dates from Sept 8 onward; and the Workers bundle-size cap rose from 10MB compressed to a flat 64MiB uncompressed across all plans.

Vercel

Spend Management is now available on Enterprise Flexible Commitment plans — budgets, alerts, and optional deploy pausing when a project overruns. The CLI also picked up sub-second static-artifact deploys, and Turbo build machines can now be opted into per-deployment rather than account-wide. Full changelog.

Kubernetes & Podman

Kubernetes v1.37.0 remains current (released Aug 26, EOL Oct 2027), with no fresh CVE in the last week. Podman's latest release bumps Buildah to v1.45.1 and Common to v0.69.2, and fixes CVE-2025-11395 — a podman load/podman volume import path where a crafted layer tarball with symlinks could overwrite host files.

AWS, Railway & Render

AWS published Security Bulletin 2026-049-AWS for CVE-2026-13769: AWS CLI v1 ≤1.44.77 and v2 ≤2.34.28 wrote credential/config files with world-readable permissions. Railway shipped Railway Sandboxes and MySQL point-in-time recovery, while Render added Blueprint (IaC) support for Render Workflows.

Identity & Authentication

Keycloak

Keycloak 26.7.4 (Sept 16) fixes a stateless replay-gate bypass tied to default MySQL/MariaDB row counts, an unauthenticated DoS via unbounded locale caching, an incomplete fix for percent-encoded semicolons bypassing matrix-parameter stripping, a username-takeover path, the impersonation privilege-escalation bug noted above, and a SAML redirect issue leaking native zlib state. It also bumps bundled Quarkus to 3.33.3.2. This follows the more critical CVE-2026-18963 (CVSS 9.1, account takeover via the reset-credentials flow) fixed in 26.7.2 last month — if you're not past 26.7.2 yet, that's the more urgent upgrade.

# Check your running Keycloak version before upgrading
curl -s https://your-keycloak-host/health | jq '.checks[] | select(.name=="ready")'
docker pull quay.io/keycloak/keycloak:26.7.4

Authentik

Authentik 2026.8.3 (Sept 17) is a maintenance release: fixed 2026.8 migration issues, a policy-binding cache-invalidation bug, an LDAP cached-searcher memory leak, and restricted avatar exposure to URL-based pictures only.

Clerk & Auth0

Clerk's Sept 3 changelog fixed ticket-based sign-in/sign-up flows that failed to finalize if started before Clerk finished loading, and added a Back button in the authenticator-app verification step. Auth0 shipped real-time notifications for enterprise-connection changes — stream connection.created/updated/deleted events to a webhook or EventBridge instead of polling the Management API — plus an early-access Member Management API for B2B organizations with bulk invites.

Better Auth & Auth.js

Better Auth 1.7.5 (Sept 14) adds database.schemaName support for direct Postgres connections:

export const auth = betterAuth({
  database: {
    provider: "pg",
    schemaName: "auth", // isolate auth tables from the public schema
  },
});

Auth.js/NextAuth's most recent security update closed four advisories across @auth/core, next-auth v4, and v5 — notably binding OAuth state/nonce/PKCE cookies to the provider that issued them, so a callback can't be replayed against a different provider. Anything pinning @auth/core exactly (@auth/sveltekit, @auth/express, DB adapters) needs a matching bump.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js canary builds fixed next/image socket-sharing, duplicate background revalidation under 'use cache', disk-cache handling of 0-byte images, and CSP nonce propagation to loading/template script tags. React 19.3.0 (Sept 9) landed <Activity> for pausing and resuming offscreen UI state without unmounting it.

Nuxt, Vue, SvelteKit, Svelte & Astro

Nuxt 4.5 brought Vite 8, Rspack 2/Rsbuild, and experimental SSR streaming — note that Nuxt 3 reached end-of-life on July 31, 2026, so anything still on the v3 line needs a migration plan, not just a patch plan. Vue core sits at 3.5.40. Svelte 5.57 added SvelteMap.getOrInsert/getOrInsertComputed and a createContext().has() check, and the sv CLI replaced its mcp add-on with ai-tools. Astro shipped 7.3.1 on Sept 3.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS 12.0.3 (Sept 15) patched microservices transport handling for Kafka and TCP sockets. Node.js's latest security release (July 29) covered 11 CVEs across the 22.x, 24.x, and 26.x lines; current stable is 26.8.1 with no September security release yet.

Fastify & Express

Fastify's v6 line, currently at 6.0.0-alpha.4 (Sept 17), fixed GHSA-4mh8-r7rc-xpvc alongside content-type parsing performance work; stable 5.x remains at 5.8.5. Express's body-parser dependency was bumped to ^2.3.0 to fix CVE-2026-12590 — an invalid limit option was silently disabling request-size enforcement, a fail-open DoS path.

ElysiaJS & Hono

Elysia 1.4.30 is now maintenance-only — security fixes going forward, no new features. Hono 4.13.8 (Sept 15) fixed a JSX/DOM performance regression on large keyed updates, an AWS Lambda streaming bug, and request-body caching.

FastAPI, Django & Laravel

FastAPI's recent release notes add Server-Sent Events support and streaming JSON Lines/binary responses via yield. Django's Sept 2 release (6.1.1) is a plain bugfix with no CVEs — the last dedicated security release (Feb 3) fixed six CVEs including SQL injection via order_by()/FilteredRelation and a DoS via ASGI requests missing Content-Length. Laravel disclosed and patched an XSS in its debug page (Sept 10), on top of a Sept 2 changelog adding a WorkerStopping event and Eloquent::insertOrIgnoreReturning.

UI Systems, Styling & Motion

shadcn/ui components now pull cn from a standalone cn package instead of hand-wrapping clsx + tailwind-merge. Radix Primitives fixed missing ARIA title/description refs on Dialog and added per-primitive subpath imports. Tailwind CSS v4.3 added first-party scrollbar utilities and @container-size support. MUI 9.4.0 shipped an opt-in theme.focusVisible for consistent keyboard focus rings. Motion 13.4.0 (Sept 14) introduced AnimateView, built on the native ViewTransition API and paired with React 19.3.

Databases, Caching & Vector Search

PostgreSQL & pgvector

PostgreSQL's Aug 13 release (18.6 / 17.11 / 16.15 / 15.19 / 14.24, plus 19 Beta 3) fixed 31 CVEs — the largest single-release count in the project's history, spanning buffer overflows, type confusion, SQL injection, and memory disclosure. If you haven't patched since mid-August, prioritize this one. pgvector's latest tagged release is 0.8.6.

Redis

CVE-2026-81934: a use-after-free in TLS pending-data processing that could allow RCE by an already-authenticated attacker. Redis's team revised severity down from an initial CVSS 9.8 to 7.5 after review, with no known active exploitation. Fixed in 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24 — patch whichever line you're on.

MongoDB

CVE-2026-82067 (CVSS 8.1, Sept 15): improper case-sensitivity handling in config validation can leave the authorization subsystem disabled at startup, letting an unauthenticated attacker perform admin operations. Fixed in Server 7.0.41, 8.0.30, and 8.3.9 — this is the sharpest security item in today's audit and should jump the queue over feature work.

ClickHouse & DuckDB

ClickHouse 26.8 LTS (Sept 1) adds background queries, pipelined SQL, and new tokenizers, but changes max_insert_threads to default to auto and alters X-ClickHouse-Format header behavior — check both before upgrading a pipeline that depends on the old defaults. DuckDB is at 1.5.5, a patch release on the Variegata line.

Database Tools, ORMs & BaaS

Prisma Compute reached general availability (Aug 28) with a free tier up to 1M monthly requests, and Prisma ORM 8 is now at release-candidate 8 with GA expected in October. Drizzle ORM remains on its 1.0.0-beta line. Supabase's Advisors now run service-health checks across Auth, Storage, Edge Functions, and Data APIs with severity levels (Sept 18). Firebase Remote Config moved to usage-based pricing on Sept 1 (100k free daily fetches, then Blaze pay-as-you-go), with A/B Testing folded natively into it.

Background Jobs, Messaging & Task Queues

BullMQ 6.3.8 (Sept 18) fixed the Postgres backend's LISTEN connection not retrying after connection errors — relevant if you've adopted the newer pluggable IQueueBackend abstraction:

import { Queue } from "bullmq";

const queue = new Queue("emails", {
  connection: { url: process.env.POSTGRES_URL },
  backend: "postgres", // now retries LISTEN drops correctly as of 6.3.8
});

RabbitMQ 4.3.6 (Sept 16) is the latest patch in its 4.3 series; 2026 has seen 21 security advisories against RabbitMQ overall, mostly medium/high with no criticals. Apache Kafka's most recent bugfix (4.3.1) fixed a Kafka Streams RocksDB native-memory leak, while two disclosed CVEs — a producer buffer-pool race and a SASL/PLAIN-SCRAM impersonation bug — are fixed in kafka-clients 3.9.2+/4.0.2+/4.1.2+. Temporal's UI Server reached 2.54.1 (Sept 11), and Temporal Cloud added Serverless Workers for AWS Lambda in public preview.

What to Patch First

If you only do three things today: patch MongoDB for CVE-2026-82067, update Keycloak to 26.7.4, and patch Redis for CVE-2026-81934. Everything else on this list is either a feature you can adopt on your own schedule or a bug fix you can pick up on the next routine bump.