September 21 Dev Stack Audit: Critical Auth.js CVE Patched, Next.js RCE Fallout, and Cloudflare's New Worker Permissions

Audit window: 2026-09-20 09:00 UTC to 2026-09-21 06:00 UTC. The headline this cycle is authentication, again: a critical CVSS 9.1 vulnerability in the Auth.js / next-auth magic-link sign-in flow is now patched, and today's automated dependency scans are still turning up last month's Next.js image-optimization RCE in projects that haven't upgraded. Cloudflare, Prisma, and the wider container and edge stack all shipped meaningful updates in the same window.

Executive Summary

• Auth.js / next-auth: CVE-2026-73420 (CVSS 9.1) lets an attacker take over an account via a Unicode homoglyph in the email sign-in flow; a second bug, GHSA-x445-f3h2-j279, left OAuth state, nonce, and PKCE cookies unbound to the provider that issued them. Fixed in @auth/core 0.41.3 and next-auth 4.24.15 / 5.0.0-beta.32.
• Next.js: last month's critical AVIF Image Optimization RCE (GHSA-2xp9-vwfh-vxw4) and a Windows-hosted-server RCE (GHSA-p293-qw3h-jr36) are still surfacing in today's npm audit scans — anything before 16.3.3, or 15.5.24 on the 15.x line, needs to move now.
• Cloudflare Workers: granular per-Worker permissions with four roles, a tripled 64 MiB bundle-size ceiling, Python 3.14 support, and a Workflows retention cut from 30 to 7 days all landed this month.
• Prisma ORM: v8.0.0-rc.8 shipped alongside a @prisma/prisma7 compatibility package for incremental upgrades; general availability is targeted for October 2026.
• Framework churn: Astro 7.3.0, Svelte 5.57 with an SvelteKit 3 release candidate, Django 6.1.1, Docker Compose v5.5.1, Bun v1.4.2, and a shadcn/ui migration to a standalone cn package.

Identity & Authentication: Critical Auth.js / next-auth CVE

Auth.js — the library behind next-auth — disclosed three vulnerabilities this cycle, the most severe of which is CVE-2026-73420, rated 9.1 on the CVSS scale. The email / magic-link sign-in flow's default normalizer validated an address before applying Unicode normalization. That ordering let an attacker submit an address containing the fullwidth commercial-at character (U+FF20) instead of the ASCII @. Because validation ran first, the malformed address passed, and the magic link was then routed to the normalized — attacker-controlled — mailbox. Anyone who knew a victim's email address could request a sign-in link for that account and read it themselves, with no interaction from the victim required.

• CVE-2026-73420 (CVSS 9.1): homoglyph bypass in the default email normalizer — magic-link account takeover with no victim interaction.
• GHSA-x445-f3h2-j279: OAuth state, nonce, and PKCE check cookies were not bound to the provider that created them, opening a cross-provider mix-up path.
• CVE-2026-73418 (CVSS 7.5): the exported getToken() helper in next-auth/jwt and @auth/core/jwt throws an uncaught exception on a malformed Authorization: Bearer header — a denial-of-service path for anything that calls it directly in middleware.

npm install [email protected]
# or, on the v5 beta line
npm install [email protected]
npm install @auth/[email protected]

If your app builds sign-in links from user-supplied email addresses anywhere outside the built-in normalizer, re-run the same homoglyph check there — the library fix does not cover custom normalizer functions passed through pages.signIn or provider callbacks.

Next.js: RCE Fallout Still Showing Up in Scans

Next.js patched two critical, unauthenticated RCEs in its August 2026 security release: a heap buffer overflow in the AVIF path of the Image Optimization API (CVSS v4 9.5, no credentials required, remotely reachable on any internet-facing deployment that processes images), and a second RCE specific to Windows-hosted servers. Both were fixed in 16.3.3, with 16.3.5 as the current patch release on that line; the equivalent fix on the 15.x branch is 15.5.24. Coverage at the time noted the AVIF path affected 10.0.0 through 15.5.23 and every 16.x release through 16.3.2. Automated npm audit runs from today still flag the pair in projects that haven't bumped past those versions — if that's you, this is not optional.

On the 16.4.0 canary line, this month picked up a web-vitals upgrade to v6, per-family Turbopack cache compression to shrink cache size, and experimental chunking controls aimed at sharing code across pages during navigation. Backports also touched next/image, standalone output, CSP nonce handling, and cache prerender signals.

Containers, Edge & Infrastructure

Cloudflare Workers

• Sept 15 — granular Worker permissions: four roles (Metadata Read-Only, Content Read-Only, Editor, Admin) for teammates, agents, and CI/CD.
• Sept 4 — Worker bundle-size ceiling tripled from a compressed 10 MB to a flat, uncompressed 64 MiB on every plan.
• Sept 8 — Python Workers support Python 3.14 for compatibility dates on or after 2026-09-08.
• Sept 1 — D1 queries that exceed daily row limits on the free tier now fail outright instead of degrading. Workflows created on or after Sept 10 on the Workers Paid plan also retain completed/errored instance state for 7 days by default, down from 30.

Docker, Podman & Vercel

Docker Compose v5.5.1 (Sept 3) fixed watch syncing into symlinked directories, watch exclusion of Dockerfiles/compose files on initial sync, lifecycle-hook output now surfacing in errors, and Windows TTY progress rendering. Podman's latest line adds a force_port_listen WSL option required for Windows-host port forwarding, maps container healthchecks to livenessProbe in podman generate kube output, reworks rootless pasta forwarding for correct IPv6 support, and reports free memory in podman info.

On Vercel, flat-rate CDN pricing landed for Pro teams on Sept 8 — a fixed monthly bill with automatic protection against viral-traffic spikes. Spend Management expanded to Enterprise Flexible Commitment plans, and mcp-handler gained WebMCP support for exposing MCP tools to in-browser agents without a separate OAuth flow.

Database Tooling: Prisma ORM 8 Release Candidate

Prisma ORM v8.0.0-rc.8 shipped alongside @prisma/prisma7, a compatibility package that lets a project run Prisma 7 and 8 side by side so teams can migrate incrementally instead of a hard cutover. General availability is targeted for October 2026.

npm install prisma@8 @prisma/prisma7
# every existing `prisma7` CLI alias keeps working while you migrate
npx prisma7 generate

Also this month, per the Prisma changelog: prepared aggregate support landed with matching PostgreSQL/SQLite doc updates covering grouped results, filtering, result types, and pagination, plus internal PSL source-provenance tracking that improves diagnostic filenames and location accuracy across the parser, SQL, Mongo, and language server.

Meta-Frameworks, UI, and Runtimes

• Astro 7.3.0 (Sept 3): latest patch on the 7.x line built on the Vite 8 pipeline and the new Rust compiler introduced in June.
• Svelte 5.57: SvelteMap gains getOrInsert / getOrInsertComputed, createContext returns a has() check, and svelte/server exports new types for server-render output and CSP sources. SvelteKit 3 is now at release-candidate stage, and the sv CLI replaced its mcp add-on with ai-tools.
• Django 6.1.1 (Sept 2): maintenance patch two weeks after the 6.1 feature release.
• shadcn/ui: components now import cn from a standalone cn package instead of a local lib/utils.ts helper. Existing projects keep working unchanged, and npx shadcn migrate cn rewrites imports and drops clsx/tailwind-merge once nothing references them.
• Bun v1.4.2: fixes a bun build rename regression that broke Elysia apps, an AsyncLocalStorage memory leak, worker_threads 'online' event ordering, GC/JIT crashes, CMYK JPEG decoding in Bun.Image, and a bun install lockfile panic.

What to Patch Today

1. next-auth / @auth/core — upgrade to 4.24.15 / 5.0.0-beta.32 / 0.41.3 immediately; this is an unauthenticated account-takeover path.
2. Next.js — confirm you're past 16.3.3 (or 15.5.24) if you serve user images through the Image Optimization API.
3. Cloudflare Workflows users relying on 30-day instance retention should export state before Sept 10-created workflows age out at 7 days.
4. Everyone else — routine version bumps (Docker Compose, Podman, Astro, Svelte, Bun) carry no urgent CVEs, but there's no reason to fall behind on them.

Version numbers and dates above are current as of this audit's window; always confirm against the linked release notes before rolling any of this out to production.