SERIES · 84 ISSUES
Dev Stack Release & Security Audit
A daily audit of new releases and security advisories across the frameworks, databases and infrastructure that web and mobile products run on, with the patches to apply first. Newest issues first.
Latest issue: Next.js RCE Patches, Docker 29.9.1, Node Oct 21 Alert
October 2026
- Next.js RCE Patches, Docker 29.9.1, Node Oct 21 AlertMonday audit: patch Next.js 16.4.1/15.5.28 for two critical RCEs, update Docker 29.9.1 (containerd 2.4.2) and prep for the Node.js Oct 21 security releases
- Weekend Release Audit: Next.js 16.4.2, Docker 29.9.1Sunday quiet before the storm: Next.js 16.4.2 and 16.5 canaries, Docker 29.9.1 with containerd 2.4.2, Keycloak 26.8.1, Node 26.12 and Redis security fixes.
- Next.js 16.4.2, Docker 29.9.1 and SvelteKit 3 UpdatesNext.js 16.4.2 follows the RCE fixes, Docker Engine 29.9.1 and Desktop 4.95 ship, Node.js previews an Oct 21 security release, and SvelteKit 3.1 lands.
- Docker 29.9.1, Node 26.12 and Next.js RCE Patch GuideDocker Engine 29.9.1 patches containerd, Node.js 26.12 and 24.22 land, and the Next.js 16.4.1 RCE fixes need a sharp 0.35.5 check on glibc Linux images.
- Next.js 16.4.1 Fixes 2 Critical RCEs, SvelteKit 3.1 OutNext.js 16.4.1 patches two critical RCEs and a Server Actions DoS, React 19.3.1 and SvelteKit 3.1 ship, and Node.js flags a high-severity fix on Oct 21.
- Next.js 16.4 Ships as a Critical Patch Lands TodayNext.js 16.4 makes Cache Components the default, a critical Windows RCE (CVE-2026-75604) is under attack, and an out-of-band security update lands today.
- Next.js 16.4, Express 5.3 & NestJS 12.1: Release AuditRelease audit for October 13, 2026: Next.js 16.4 breaking defaults, Express 5.3 security fixes, NestJS 12.1.3, Nuxt 4.6.1 and a Next.js patch due Oct 14.
- Express 5.3 Security Fixes, Nuxt 4.6.1 and Hono 5 RCExpress 5.3 patches qs, proxy-addr and body-parser advisories, Nuxt 4.6.1 lands 25 fixes, and Hono 5, Vue 3.6 and Elysia 2 move toward stable releases.
- Next.js Security Update Oct 14 & Dev Stack Release LogDaily audit: Next.js Oct 14 security update (2 Critical), Node.js 26.11.1, Astro 7.3, SvelteKit 3.0, Prisma 8 RC, Firebase 13 and more. Upgrade notes.
- Nuxt 4.6, SvelteKit 3 and Firebase 13 Release AuditDev release audit: Nuxt 4.6 adds Vapor and a new CLI, SvelteKit 3 and Firebase 13 ship breaking changes, and Astro 7.3.7 patches CSRF and Host checks.
- Next.js 16.4 Ships, 16.3.8 Fixes Seven Security BugsNext.js 16.4 makes Cache Components the default for new apps, while 16.3.8 and 15.5.27 patch seven flaws, including a high-severity SSRF. Upgrade now.
- Keycloak 26.8, Compose 5.6 and Node 26.10 Release AuditKeycloak 26.8.0 adds SCIM and OID4VCI, 26.7.5 fixes 13 CVEs, Docker Compose 5.6 adds jobs and Node.js 26.10 lands new utilities. Upgrade notes inside.
- SvelteKit 3 Ships, Next.js 16.3.8 Patches 7 AdvisoriesSvelteKit 3.0 moves config to Vite and drops $app/stores, Next.js 16.3.8 fixes an image SSRF, Node 22.23.3 patches HTTP/2, and Motion 14 lands. Patch now.
- Better Auth 1.7.7 Magic Link Fix, Hono 4.13.13 UpdateBetter Auth 1.7.7 patches a magic link account takeover and Hono 4.13.13 adds mount middleware after a serveStatic bypass fix. Plus NestJS 12.1 and BullMQ.
- Dev Stack Release Audit: Next.js 16.3.8 SSRF Fix, Keycloak 26.7.4 and PostgreSQL Security PatchesNext.js 16.3.8 patches a high-severity SSRF, Keycloak 26.7.4 fixes six CVEs, and PostgreSQL ships security updates. See what to upgrade and how to patch.
- Dev Stack Release Audit: Next.js 16.3.6 RCE Fix, SvelteKit 3.0 and GitHub CLI 2.102 Security PatchesCritical Next.js ImageResponse RCE patched in 16.3.6, SvelteKit 3.0 ships breaking changes, gh CLI 2.102 fixes four CVEs, and GitHub tightens vuln reports.
- Next.js 16.3.8 Security Release: 7 Flaws Fixed TodayNext.js 16.3.8 and 15.5.27 patch seven flaws, including a high-severity image SSRF. Plus Node.js 26.10 and 24.21 LTS notes and the exact upgrade steps.
September 2026
- Next.js Security Patch Due Today, Docker Desktop 4.93Next.js 16.3.8 targets 9 flaws today, Docker Desktop 4.93.0 patches a VM socket forwarding bug plus CVE-2026-53495, and Node.js ships 26.10.0 and 22.23.3.
- Dev Release Radar: Next.js 16.3.7 Due, Docker 4.93 OutNext.js schedules a 9-CVE patch for Sept 30, Docker Desktop 4.93 fixes a socket forward flaw, Keycloak 26.7.4 closes 6 CVEs, and Postgres 19 Beta 4 lands.
- Dev Release Radar — September 28, 2026: Next.js Patches a Critical next/og RCE as MongoDB Closes a Critical Auth BypassNext.js shipped a critical RCE fix in next/og, MongoDB patched a critical auth bypass, and Docker, Podman, Redis, and RabbitMQ closed serious CVEs today.
- Dev Release Radar — September 27, 2026: PostgreSQL Patches Five CVEs, RabbitMQ Fixes a JWKS DoS FlawPostgreSQL patches five CVEs, RabbitMQ fixes a JWKS DoS bug, and Kubernetes closes a cross-namespace pod flaw, plus Next.js, Keycloak, and Redis updates.
- Next.js RCE Patch, Postgres 28 CVEs: Sept 26 RoundupNext.js patches a critical Satori RCE, Postgres fixes 28 CVEs, Keycloak closes an account takeover bug, and K8s 1.37 ships in today's dev release roundup.
- Next.js RCE, 6 Keycloak CVEs & a Kubernetes Bypass: The Sept 25, 2026 Dev Stack Patch RoundupSept 25, 2026 audit: a critical Next.js RCE, 6 Keycloak CVEs, a Kubernetes bypass, plus Fastify, NestJS, Podman and Auth0 patches you should apply today.
- Critical Next.js RCE Fixed as Dev Stack Ships UpdatesNext.js patched a critical next/og RCE, Redis and RabbitMQ fixed active CVEs, and Nuxt and Django shipped security patches in today's full dev stack audit.
- Daily Dev Release Audit: Next.js CVE Patch, Postgres RCE Fix & Supabase Breaking ChangeDaily dev changelog: Next.js critical patch, Postgres RCE fix, Keycloak CVEs, Supabase's logs.all removal, plus Docker, Cloudflare and Prisma updates.
- September 22 Dev Stack Audit: Next.js Ships Emergency Security Patch, Redis Fixes Critical RCE Bug, Auth0 Discloses Four CVEsA critical out-of-band Next.js release ships today with a critical Redis RCE fix, a Fastify HTTP/2 DoS advisory, four new Auth0 CVEs, and a Podman patch.
- September 21 Dev Stack Audit: Critical Auth.js CVE Patched, Next.js RCE Fallout, and Cloudflare's New Worker PermissionsA critical Auth.js CVE (CVSS 9.1) is now patched, Next.js's RCE fixes resurface in today's npm scans, and Cloudflare ships granular Worker permissions.
- September 2026 Dev Stack Release Audit: MongoDB and Keycloak Patch Auth Bypass BugsSept 20, 2026 stack audit: MongoDB fixes a CVSS 8.1 auth-bypass flaw, Keycloak 26.7.4 closes six CVEs, Redis patches an RCE bug, plus Docker and Laravel.
- September 2026 Stack Release Audit: Keycloak, Docker, Next.js and MoreSept 2026 stack audit: Keycloak patches 6 CVEs, Docker fixes a VM panic bug, Cloudflare Workers hit 64MiB, plus Next.js, Postgres, and Django updates.
- September 2026 Dev Stack Release Roundup: Keycloak, Fastify, Hono, and Podman Ship Security Patches as React 19.3 Debuts View TransitionsKeycloak, Fastify, Hono, and Podman patched security flaws this week as React 19.3, Astro, Laravel, and Motion shipped new features across the web stack.
- Sept 17 2026 Dev Stack Release Audit: Fastify DoS Fix, MongoDB's Critical CVE, and a Wave of Sept 16 PatchesDaily release audit: Fastify's HTTP/2 crash-DoS fix, MongoDB's critical auth-bypass CVE, plus new Podman, Node.js, NestJS, Laravel and Astro releases.
- Daily Dev Stack Digest — September 15, 2026: Keycloak's Critical Auth-Bypass Chain, Next.js 16.3.5, and a Docker CVE PatchDaily stack audit: critical Keycloak auth-bypass CVEs risking account takeover, plus Next.js 16.3.5 fixes, Docker CVE-2026-17106 patch, and Prisma 8 news.
- Sep 14 Release Watch: MongoDB CVEs & Cloudflare RCEMongoDB patches a CVSS 9.2 flaw, Cloudflare ships an emergency WAF rule for an actively exploited Adobe Commerce RCE, and Docker Desktop closes two CVEs.
- Sep 13 Release Watch: Keycloak, Vercel, Redis & PodmanThree new Keycloak CVEs leave two unpatched, Vercel ships flat-rate CDN pricing, Redis fixes a silent auth bypass, and Docker plus Podman close CVEs today.
- Dev Release Radar — September 12, 2026: Keycloak Closes 20 CVEs, Docker and Podman Patch a Container EscapeKeycloak 26.7.3 closes 20 CVEs, Redis patches a TLS use-after-free flaw, Docker and Podman fix a container-escape bug, and React 19.3 ships stable now.
- Daily Dev Watch: Auth0, Postgres & Redis Security FixesCritical CVEs hit Auth0, PostgreSQL, Redis, Nuxt, and Docker this week, alongside major feature releases from React 19.3, Keycloak, and Cloudflare Workers.
- Dev Stack Release Audit — September 10, 2026: Keycloak Patches Critical Account-Takeover Flaw as PostgreSQL Fixes a 12-Year RCE BugKeycloak patches a critical account-takeover bug and PostgreSQL fixes a 12-year RCE flaw, as Cloudflare, Vercel, and Better Auth ship updates on Sept 10.
- Dev Stack Release Audit — September 9, 2026: Fastify Patches 4 CVEs, Docker/Podman Fix Shared RCEFastify shipped four High-severity security patches on Sept 4, while Docker and Podman fixed a shared RCE flaw and Cloudflare raised Worker size limits.
- Sept 2026 Dev Stack Release Audit & Security RoundupDaily audit of critical CVEs and major releases in Docker, Next.js, Keycloak, PostgreSQL, and Redis, with verified links to help you patch the stack today.
- Dev Release Radar — September 7, 2026: PostgreSQL Patches a Record 28 CVEs as Keycloak and Next.js Fix Critical RCEsPostgreSQL patches a record 28 CVEs, Keycloak fixes a critical unauthenticated auth bypass, and Fastify, Hono, Astro, Vue, and BullMQ ship fresh releases.
- Dev Release Radar — September 6, 2026: Better Auth Ships v1.7.3, Fastify and Hono Patch Security Holes, Docker 29.8 LandsBetter Auth 1.7.3 adds HIBP password checks, Fastify and Hono ship security patches, Docker 29.8 lands, and Podman fixes a flaw shared with Docker Desktop.
- Daily Dev Stack Release Audit — September 5, 2026: Docker Ships Engine 29.8.0 as Cloudflare Doubles Worker Limits and RabbitMQ Patches an OAuth Secret LeakDocker Engine 29.8.0 and Compose 5.5.1 ship as Cloudflare raises Worker limits to 64MiB, RabbitMQ patches an OAuth leak, and BullMQ closes a security gap.
- Daily Dev Stack Release Audit — September 4, 2026: Keycloak Patches Unauthenticated Password-Reset Bypass as Redis and PostgreSQL Ship Security FixesKeycloak fixes an unauthenticated password-reset bypass, Redis patches CVE-2026-81934, and PostgreSQL closes three RCE-class flaws. Full dev stack audit.
- Daily Dev Stack Release Audit — September 3, 2026: Keycloak and Podman Patch Critical CVEs as Kubernetes 1.37 Ships HPA Scale-to-ZeroKeycloak fixes ~20 CVEs, Podman patches a tar path traversal flaw, and Kubernetes 1.37 ships HPA scale-to-zero beta. See today's dev stack release audit.
- Redis, MongoDB, Docker Fix Critical RCE Security FlawsDaily dev-stack audit: Redis, MongoDB, and Docker patch critical security flaws while Next.js, Postgres, Supabase, and Vercel ship key platform updates.
- Critical Security Patches Hit Next.js, Docker, KeycloakNext.js, Docker, Keycloak, PostgreSQL, and Redis shipped security patches this week. Full changelog audit across the modern dev stack, with source links.
August 2026
- Dev Stack Release Radar — August 31, 2026: Critical Patches for Next.js, Keycloak, Redis & MoreCritical security patches land in Next.js, Keycloak, Redis, Node.js, and Django this week, alongside major releases in Docker, Kubernetes, and NestJS v12.
- Aug 2026 Patch Wave: Keycloak, Next.js, Postgres, RedisCritical patches hit Keycloak, Next.js, PostgreSQL, and Redis this week, plus major Kubernetes and Django releases. Here's what to patch now, and why.
- Daily Stack Watch: NestJS 12 Ships With ESM Support, Hono Patches a DoS Bug, and Astro, ClickHouse, and Prisma All Release UpdatesNestJS 12 ships with ESM support, Hono patches a parseBody DoS bug, and Astro, ClickHouse, Prisma Compute, and MUI all ship updates on August 29, 2026.
- Daily Stack Watch: Next.js Patches Two Critical RCEs, Redis Fixes a Heap Overflow, Kubernetes 1.37 ShipsNext.js patches two critical RCEs, Redis 8.8.2 fixes a heap overflow, and Kubernetes 1.37 ships. Today's audit covers Cloudflare, Supabase, and BullMQ v6.
- Daily Dev Stack Audit — August 27, 2026: BullMQ, Node.js 26.8, and NestJS Round Out a Quieter WeekBullMQ's fifth patch this week, Node.js 26.8, and NestJS crash fixes ship as Railway retires Config as Code tomorrow. Full dev stack audit, Aug 27, 2026.
- Daily Dev Stack Audit: Next.js Ships Emergency RCE Patch, Kubernetes 1.37 LandsNext.js shipped an emergency patch for two critical RCE flaws, Kubernetes 1.37 lands with breaking changes, and Hono issued a same-day security fix today.
- Daily Dev Stack Audit: Next.js Security Release Lands Tomorrow, BullMQ Breaks APIDaily stack audit: Next.js's security release lands tomorrow, BullMQ breaks legacy APIs, Astro ships two patches, and Authentik earns OpenID certification.
- Daily Dev Stack Audit: Redis, Keycloak & MongoDB Patch Critical CVEsDaily stack audit: Redis, Keycloak, and MongoDB patch critical CVEs, while Docker, Prisma, and Next.js all ship breaking changes and new features today.
- Daily Dev Stack Audit: Security Sweep Hits Postgres, Redis, RabbitMQ & MoreDaily stack audit: critical CVEs hit Postgres, Redis, MongoDB, RabbitMQ; Next.js, Django, and Better Auth ship breaking changes worth reviewing today.
- Stack Audit: Keycloak, Fastify, DuckDB — Aug 20, 2026Aug 20, 2026 stack audit: Keycloak's 5-CVE patch, Fastify's security release, DuckDB 2.0's rewrite, ElysiaJS's beta, plus Docker and Redis fixes inside.
- Stack Audit: RabbitMQ's 10-Advisory Security Drop, Keycloak 26.7.1, Authentik 2026.8, Better Auth 1.7, and Prisma ORM 8 RCs — August 16-19, 2026RabbitMQ patches 10 advisories, incl. a CVSS 8.2 Web STOMP flaw. Keycloak, Authentik, Better Auth, Prisma ORM 8 ship major updates in today's stack audit.
- Dev Stack Release Audit — August 18, 2026: RabbitMQ's Ten-Advisory Disclosure, Better Auth v1.7.0, and MongoDB's Confirmed CVE PatchesDaily dev-stack audit: RabbitMQ discloses ten advisories, Better Auth ships v1.7.0 with session-revocation fixes, and MongoDB confirms its CVE-2026-18691 patches.
- Dev Stack Release Audit — August 17, 2026: MongoDB's Critical Auth Bypass, PostgreSQL's 28-CVE Patch, and BullMQ's Security FixDaily dev-stack audit: MongoDB patches a critical intra-cluster auth bypass, PostgreSQL fixes 28 CVEs, and BullMQ ships a security patch across the stack.
- Dev Digest: Postgres, MongoDB & Keycloak CVEs PatchedPostgreSQL, MongoDB, and Keycloak shipped critical CVE patches this week, while Next.js, Vue 3.6, Astro, and NestJS pushed major releases across the stack.
- Dev Release Radar — August 15, 2026: Auth0 Reaches GA, Better Auth Patches an SSO Race ConditionAuth0's password policy reaches GA, Better Auth fixes an SSO race bug, and NestJS, Fastify, Hono ship coordinated patches. Cloudflare, Railway update too.
- Dev Stack Release Audit — August 14, 2026: PostgreSQL Patches 28 CVEs, MongoDB ODBC Driver Hits Critical 9.8Daily release audit for Aug 14, 2026: PostgreSQL patches 28 CVEs and skips 18.5, MongoDB's ODBC driver hits critical CVSS 9.8, plus Docker Desktop fixes.
- Dev Stack Release Audit — August 13, 2026: Critical CVEs Hit MongoDB, Redis, Keycloak & Node.jsDaily release audit for August 13, 2026: critical CVEs in MongoDB, Redis, Keycloak, Node.js, and Nuxt, plus new releases across Next.js, Docker, and more.
- Aug 8-11 Dev Roundup: Keycloak, Django, BullMQ FixesVerified Aug 8-11 audit: Keycloak 26.7.1 patches 12 CVEs, Django fixes 4 CVEs, BullMQ 6.0.11 ships security patches, plus Docker, Vercel and Node.js news.
- Aug 7-10 Dev Roundup: Prisma v8, Next.js, Fastify, HonoVerified Aug 7-10 audit: Prisma v8 RC, Next.js 15.5.23, Fastify 5.11.3, Hono 4.13.1, BullMQ 6.0.9, Auth0 token exchange, and Vercel, Cloudflare infra news.
- Dev Stack Radar: Django & Keycloak Ship Security FixesToday's stack audit: Django patches a high-severity CVE, Keycloak fixes five auth flaws, and Prisma v8's first RC lands breaking driver interface changes.
- Dev Stack Radar: Django 6.1, Redis CVE & Docker ComposeToday's dev stack audit: Django 6.1 ships plus a 4-CVE security release, Redis 8.10 goes GA alongside a critical RCE patch, and Docker Compose v5.4 lands.
- Dev Release Radar — August 7, 2026: Django 6.1 Ships While Patching a Critical RCEDjango 6.1 ships alongside a critical RCE patch (CVE-2026-15307), Motion 13.0 breaks its API, Keycloak closes five CVEs, and BullMQ ships four patches.
- Dev Release Radar — August 6, 2026: Keycloak Closes Five CVEs, Next.js Ships Instant NavigationsKeycloak 26.7.1 closes five CVEs, Next.js 16.3 ships Instant Navigations, Motion 13.0 lands a breaking change, plus Node.js, Laravel, Fastify patches.
- Dev Release Radar — August 5, 2026: Django Patches a Critical SSRF/RCE Chain, Hono Closes Four CVEsDjango 6.0.8 patches four CVEs including a GDALRaster SSRF flaw, Hono closes four advisories, and Better Auth, Clerk harden against enumeration attacks.
- Dev Release Radar — August 4, 2026: Redis Patches an Actively-Exploited RCE ChainRedis patches five CVEs including active RCE exploits, Next.js and Nuxt close security holes, and BullMQ ships a breaking v6 in this dev stack roundup.
- Dev Release Radar — August 3, 2026: Next.js, Nuxt & Node Patch Critical CVEsNext.js patches three High CVEs, Nuxt fixes a Critical DevTools RCE, Node.js closes 11 CVEs, and BullMQ ships a breaking v6 in today's dev stack roundup.
- Dev Release Radar — Auth0, Clerk, Cloudflare, Next.js & BullMQ Updates (Aug 2, 2026)Auth0 adds Global Search, Clerk ships OIDC SSO, Cloudflare enables MCP OAuth, and dated patches land across Next.js, Fastify, Hono, shadcn/ui, and BullMQ.
- Daily Stack Watch — August 1, 2026: RabbitMQ Leaks OAuth2 Secrets, pgvector Fixes a Buffer OverflowRabbitMQ's CVE-2026-57219 leaks OAuth2 secrets via an unauthenticated endpoint, pgvector fixes a buffer overflow, and Clerk adds self-serve OIDC SSO today.
July 2026
- Node.js Patches 11 CVEs as BullMQ Ships Breaking v6.0.0Node.js patches 11 CVEs across three release lines, and BullMQ ships a breaking v6.0.0, while Keycloak, Firebase, and Redis ship security fixes today.
- Daily Stack Watch: Nuxt, Redis, MongoDB and Node.js Ship Critical PatchesDaily release audit: Nuxt fixes a template-injection RCE, Redis and MongoDB patch critical CVEs, and Node.js, Docker, and Podman ship security fixes today.
- Daily Dev Stack Release Audit — July 29, 2026: Node.js's Delayed Security Patch Lands as Laravel, Prisma, and Auth0 Ship New FeaturesNode.js ships its delayed security patch as Laravel hardens maintenance auth, Prisma patches a flagged dependency, and Auth0 previews Cross App Access.
- Daily Dev Stack Release Audit — July 28, 2026: Redis, MongoDB, and Nuxt Rush Out Critical Security PatchesRedis fixes an RCE chain, MongoDB discloses 18 CVEs including a 9.2-severity bug, and Nuxt patches critical RCEs — today's full dev stack security audit.
- Daily Dev Stack Release Audit — July 27, 2026: Node.js, Redis, and Next.js Rush Out Critical Security PatchesNode.js pre-announces security fixes, Redis patches a RESTORE bug, and Next.js closes nine CVEs — today's full dev stack release audit and patch guide.
- Daily Release Radar: MongoDB, Redis & Next.js Ship Critical Security Patches (July 26, 2026)MongoDB patches 16 CVEs (one critical), Redis ships urgent follow-up fixes, and Next.js's security program continues. Dev-stack audit for July 26, 2026.
- Daily Release Radar: Security Patches & Feature Drops Across the Modern Dev Stack (July 25, 2026)Next.js patches 8 CVEs, Docker fixes 5 flaws, RabbitMQ leaks OAuth secrets, Keycloak ships 3 fixes. Daily audit across 30+ frameworks, databases, tools.
- Redis Fixes a Critical RCE, Supabase Defaults to Envoy, and the Queue Layer Ships Security Patches: July 24, 2026 Developer ChangelogRedis 8.6.5 fixes a critical RCE flaw, Supabase defaults to Envoy, and BullMQ, Temporal, RabbitMQ, and Kafka ship security fixes in today's dev changelog.
- Node.js Flags a Major Security Release as the Auth Stack Quietly Hardens: July 23, 2026 ChangelogNode.js flags a HIGH-severity release for July 27, Authentik and Better Auth harden security, and Kubernetes 1.36.3 fixes a kubelet memory leak today.
- Next.js, Keycloak & Hono Patch Critical CVEs This WeekJuly 22, 2026: Next.js patches 9 CVEs, Keycloak and Authentik fix account-takeover bugs, Hono discloses 3 flaws, plus Docker and Django security fixes.