Stack Audit: Keycloak, Fastify, DuckDB — Aug 20, 2026

Twenty-six tools across identity, edge infrastructure, meta-frameworks, backend runtimes, and data stores shipped updates in the last few days. The headline items are three separate security releases — Keycloak, Fastify, and Redis — landing within 48 hours of each other, alongside DuckDB's breaking 2.0 preview and ElysiaJS's ground-up rewrite. Here's what changed and what to do about it.

Executive Summary

• Keycloak 26.7.2 patches five CVEs, including an unauthenticated account-takeover flaw in the reset-credentials flow (CVE-2026-18963) — upgrade immediately.
• Fastify 5.12.1 fixes a schema-validation bypass and a trustProxy header-spoofing regression (CVE-2026-18504, CVE-2026-16732).
• Redis 8.2.9 closes a heap out-of-bounds write in CMSketch RDB loading (CVE-2026-62356) plus several unpatched-CVE memory-safety bugs.
• Docker's go-archive library had a high-severity path-traversal advisory (CVE-2026-17106, "CopyEscape") patched across Engine 29.7.2 and Desktop 4.86.0.
• DuckDB previews v2.0 "Cyanoptera", a breaking rewrite with a new storage format, a PEG-based parser, and a VARIANT type.
• ElysiaJS 2.0.0-beta.6 ("DayDream") ships a rewrite cutting bundle size by more than 50%, with a codemod for migration.
• Better Auth 1.7.1 follows 1.7.0's OAuth 2.1 defaults, DPoP-bound tokens, and OIDC back-channel logout.
• Laravel 13.26.0/13.26.1 hardens validation (loose-comparison bypass in the `in` rule) alongside new queue and Eloquent features.

Identity & Authentication

Keycloak 26.7.2 — five CVEs, upgrade now

Keycloak's 26.7.2 patch landed August 19 and addresses five vulnerabilities disclosed since 26.7.1. The most severe is CVE-2026-18963, an unauthenticated account takeover via a bypass in the reset-credentials flow. It's joined by CVE-2026-14613 (fine-grained admin permissions bypass via the role-groups endpoint), CVE-2026-15945 (group hierarchy search discloses hidden parent groups under FGAP v2), CVE-2026-17048 (the Admin REST API leaks vault-resolved, rotated client secrets), and CVE-2026-15571 (a predictable account-linking hash enabling takeover). The release also bumps Quarkus to 3.33.3.1 and fixes roughly fifteen other bugs across WebAuthn, SCIM, and OIDC client secrets. Given the account-takeover CVEs, this is not a patch to defer.

Better Auth 1.7.1 — OAuth 2.1, DPoP, and device flow

Better Auth's 1.7.0 release (August 18) switched to OAuth 2.1 defaults, added DPoP sender-constrained tokens per RFC 9449, implemented the OAuth device authorization grant (RFC 8628), and added OIDC back-channel logout. The same-day 1.7.1 patch adds native database-transaction support for test instances on PostgreSQL/MySQL, with no required project changes.

Clerk ships biometric sign-in, Auth0 adds per-app rate limits

Clerk's Expo, iOS, and Android SDKs now support enrolling a device as trusted and signing back in with Face ID, Touch ID, or Android biometrics, backed by a device-bound challenge where the private key never leaves the device. Separately, Auth0's Custom Rate Limits (early access) let teams set per-application ceilings under the tenant's global limit, returning HTTP 429 without consuming global quota — configurable to block or just notify on breach.

Containers, Edge & Cloud

Docker's "CopyEscape" path-traversal advisory

A high-severity (CVSS 7.1) path-traversal flaw in moby/go-archive's tar-extraction routines — used by `docker container cp` — let a malicious container craft an archive with symlink/traversal sequences to write files outside the copy destination on the host. It's fixed in go-archive 0.3.0, Docker Engine/CLI 29.7.2, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0.

Cloudflare Workers gets Access built in

Cloudflare's Access on Workers (August 14) lets a policy be applied to a single Worker or to every Worker on an account, protecting associated domains, Custom Domains, and preview URLs automatically as routes change. An account-wide toggle can make all Workers private-by-default, with a per-Worker bypass for public ones; identity is readable in-code via `ctx.access.getIdentity()`, and `wrangler dev` now supports local Access policy testing.

AWS patches Corretto, Render ships CLI v2.24

AWS pushed a Critical Security Patch Update for Corretto (August 18) across every supported LTS and feature-release line — 26.0.2.11.1, 25.0.4.8.1, 21.0.12.9.1, 17.0.20.10.1, 11.0.32.10.1, and 8u504. On the platform side, Render CLI 2.24.0 (August 19) ships alongside beta Python and TypeScript SDKs for programmatic access, and Windows builds now ship as `render.exe` instead of a versioned filename.

Meta-Frameworks & Core Web

Next.js's 16.3 release (patched to 16.3.1) remains the framework's biggest jump since 16.0: Turbopack dev now uses up to 90% less memory via disk caching and eviction, `next build` gets disk-cache-based incremental builds up to 5.5x faster, and SSR moved to native Node.js streams for roughly 22% higher request throughput. It also ships opt-in "Instant Navigations" — Partial Prefetching, improved ISR, and a Navigation Inspector devtool.

On the Svelte side, @sveltejs/[email protected] (August 18) fixes eager reads of `$app/state` during module init, while the preview track hit 3.0.0-next.24 the same day this article published, adding `QUERY` method support in `+server.js`. Compiler-side, [email protected] fixed an each-block fast-path bug during pending batches.

Astro's 7.2.4 (August 19) fixes builds hanging on malformed images and corrects base-path stripping so paths like `/docs-archive/page` no longer wrongly match a `/docs` base. Vue's 3.6.0-rc.4 (August 14) is feature-complete for Vapor Mode, its new compilation strategy targeting Solid/Svelte-5-level performance, while stable Nuxt 4.5.2 shipped lazy imports and island-payload fixes. Nuxt teams still catching up should note the July 27 coordinated advisory covering a critical DevTools RPC RCE (CVE-2026-71319) and a route-rule middleware bypass (CVE-2026-53721), fixed in 4.5.1/3.21.10.

Backend Frameworks & Runtimes

Fastify closes a validation bypass and header-spoofing bug

Fastify's 5.12.1 security release (August 18) fixes two moderate-severity issues: CVE-2026-18504, where a primitive-typed body schema (e.g. integer) gets coerced and validated internally but `request.body` still exposes the original unvalidated raw value to handlers; and a `trustProxy` regression where setting a numeric hop-count never actually checked the connecting address, letting an attacker with direct network access spoof X-Forwarded-* headers. The fix disables the numeric form of `trustProxy` entirely — audit any config using it.

ElysiaJS 2.0 "DayDream" and Hono 4.13.3

ElysiaJS's 2.0.0-beta.6 continues an eight-month ground-up rewrite: over 50% smaller bundles than 1.4, roughly 30% faster cold starts, ahead-of-time compilation via Bun/Vite/esbuild/rspack plugins, an Adapter v2 for Node portability, and RFC 9457 Problem Details for error handling — with a codemod covering about 95% of the migration automatically. Meanwhile Hono 4.13.3 landed routine fixes: corrected ETag handling for 304 responses, an `Origin` header on CORS preflight responses, and OPTIONS requests exempted from CSRF validation.

Laravel hardens validation, NestJS patches SSE

Laravel's 13.26.0 (with a same-day 13.26.1 patch reverting a builder addition) closes a loose-comparison bypass in the `in` validation rule and tightens temporary-upload-URL parameter handling — both backported to the 12.67.0 LTS branch. It also adds a `JobReleased` queue event and read-through filesystem caching. Separately, NestJS 11.2.1 fixed an early-return abort issue in Server-Sent Events, following 11.2.0's new HTTP `QUERY` method support.

Databases & Data Infrastructure

Redis patches a heap out-of-bounds write

Redis Open Source 8.2.9 is a security-urgency release fixing CVE-2026-62356, a miscalculated buffer size in CMSketch RDB loading that causes a heap out-of-bounds write. It also patches several unassigned-CVE issues: TopK heap cleanup out-of-bounds access, a TLS pending-data use-after-free, an ACL key-permission bypass affecting `SORT`/`GEORADIUS`/`XREAD`/`XREADGROUP`, and Vector Set use-after-free bugs. Upgrade priority should match any Redis 8.2.x deployment handling untrusted RDB files or Vector Set workloads.

DuckDB previews a breaking 2.0

DuckDB's v2.0 preview "Cyanoptera" is a major breaking release: a new default storage format, a fully rewritten C API, and a PEG-based parser replacing the Postgres-derived one. It adds "DuckDB as a server" via a new Quack protocol and `CONNECT` statement, a `VARIANT` semi-structured type with shredded execution, `BEFORE`/`AFTER` triggers, `NEAREST` joins for similarity search, DML inside CTEs, and drops ICU for a native timezone/collation implementation reported 2–2.6x faster. Recursive CTEs are reportedly around 40x faster.

On the analytics side, ClickHouse 26.7 picked up patch and LTS builds on August 19 following its July minor with 61 new features and 329 bug fixes, including faster GROUP BY...ORDER BY...LIMIT and EXPLAIN ANALYZE. MongoDB Atlas reached general availability on automated embedding generation via Voyage AI models, bundling a `voyage-code-4` model tuned for agentic code retrieval.

UI, ORMs & Tooling

shadcn/ui shipped a new Questionnaire component for multi-step question flows across all eight design styles. Drizzle ORM's 1.0.0-rc.5 build adds MSSQL and CockroachDB dialects and a rewritten drizzle-kit with DDL-based snapshots (introspection cut from ~10s to under 1s) — the stable npm tag remains 0.45.2 while v1 finishes its RC cycle. Firebase's JS SDK 12.18.0 removed the deprecated Imagen methods in favor of Gemini image models, and BullMQ 6.1.2 landed dependency and bug-fix patches on top of its new pluggable `IQueueBackend` abstraction supporting Redis and PostgreSQL backends.

What to Prioritize

• Patch Keycloak to 26.7.2 first — the reset-credentials account-takeover bypass is exploitable without authentication.
• Audit any Fastify service using numeric `trustProxy` values and upgrade to 5.12.1.
• Check Redis 8.2.x deployments that process untrusted RDB files or use Vector Set, and upgrade to 8.2.9.
• Review Docker Engine/Desktop versions against 29.7.2 / 4.86.0 if `docker cp` runs against untrusted container content.
• Treat ElysiaJS 2.0 and Drizzle 1.0 as beta/RC — track their codemods before migrating production services.