---
title: Patch the 2026 developer stack in this order
description: A working list of 27 dates, from 26 January through 3 November 2026, covers Django, Next.js, PHP, Node.js, Docker, nginx, and npm. Axios 1.14.1 and 0.30.4 were malware for about 3 hours on 31 March.
url: https://www.bravelo.co/blog/developer-stack-security-2026/
datePublished: 2026-11-05T00:00:00.000Z
dateModified: 2026-11-05T00:00:00.000Z
author: palaniappan-p
category: Security & Compliance
tags: supply-chain, nextjs, nodejs, php, docker, nginx
---

# Patch the 2026 developer stack in this order

> A working list of 27 dates, from 26 January through 3 November 2026, covers Django, Next.js, PHP, Node.js, Docker, nginx, and npm. Axios 1.14.1 and 0.30.4 were malware for about 3 hours on 31 March.

On 3 November 2026, Django, Next.js, and Docker Engine each shipped a security release. Those three sit at the end of a working list of 27 dates, from the 26 January React Server Components update through that morning. Two dates were malware placed in packages people already install. The others were vulnerability fixes, and several apply only when you use a named feature.

There is no client silhouette in this post. Counts and versions come from the vendor and government pages linked below. We did not run the payloads.

> **Short answer:** Search lockfiles for axios 1.14.1, axios 0.30.4, and plain-crypto-js. If you find them, rotate secrets from a different machine. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and Node.js to 22.23.4, 24.22.1, or 26.12.1. Bump other frameworks when the advisory names a feature you run.

## Key facts (verified 2026-11-05)

- Axios 1.14.1 was published at 00:21 UTC on 31 March 2026, and both malicious versions were removed at 03:15 UTC. The maintainer describes that window as about 3 hours. [Postmortem](https://github.com/axios/axios/issues/10636)
- Microsoft counts Axios above 70 million weekly downloads and attributes the 31 March publish to Sapphire Sleet. [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Microsoft says CISA added both to the Known Exploited Vulnerabilities catalog on 26 October 2026. [Microsoft](https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers)
- Node.js 22.23.4, 24.22.1, and 26.12.1, released 21 October 2026, include the Brotli decoder fix CVE-2026-111497. [Node.js](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- Django 6.1.3, 6.0.10, and 5.2.19 on 3 November 2026 fix six security issues. [Django](https://www.djangoproject.com/weblog/2026/nov/03/security-releases/)
- TanStack records 84 malicious versions across 42 packages, published between 19:20 and 19:26 UTC on 11 May 2026. [TanStack](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)

The same pages support the four figures below.

- **27 dates** from 26 January through 3 November 2026.
- **~3 hours** on npm for Axios 1.14.1 and 0.30.4.
- **6 CVEs** in the 3 November Django release.
- **84 versions** TanStack published in six minutes on 11 May.

## Malware in packages you already install

A version bump on a clean laptop does not clean a laptop that already ran the bad install. The payload runs when the package manager installs or updates.

### Axios on 31 March

Microsoft's 1 April write-up says axios@1.14.1 and axios@0.30.4 pulled in plain-crypto-js@4.2.1, which downloaded a remote access trojan for macOS, Windows, and Linux. The maintainer's postmortem says the npm account was the lead maintainer's, reached through social engineering, and that the malicious versions were live for about 3 hours.

> **What broke** — 31 March 2026, from the Axios maintainer's postmortem, not from a system we operated. axios@1.14.1 was published at 00:21 UTC. axios@0.30.4 followed around 01:00 UTC. Community issues the same hour were the detection. npm removed both versions at 03:15 UTC. Cleanup the maintainer names: move off those two versions, delete plain-crypto-js, and rotate every secret on that machine from a different computer. A CI job that injected secrets during the bad install needs those secrets rotated too.

The maintainer names the network indicators sfrclak[.]com and 142.11.206.73 on port 8000. Microsoft's write-up names 142.11.206[.]72 on the same port. Search for both. CISA's alert is dated 20 April and describes this same 31 March publish.

The 16 April mark on the working list is a discovery date inside advisories GitHub published on 24 April. CVE-2026-42044's timeline says the issue was found on 16 April and the proof was checked the same day. The advisory itself is dated 24 April, and the patched 1.x release it names is 1.15.2. Sibling advisories that day, including a no_proxy gap, name 1.15.1 and 0.31.1. There was no second malicious Axios publish on 16 April. Install 1.15.2 on the 1.x line after the machine is clean. [GHSA-3w6x-2g7m-8v23](https://github.com/advisories/GHSA-3w6x-2g7m-8v23)

### npm and PyPI from 29 April to 11 May

NHS England Digital alert CC-4781 calls this wave Mini Shai-Hulud. It dates malicious uploads to 29 April and 11 May 2026. The alert names TanStack, Mistral AI, UiPath, and OpenSearch on npm, and mistralai 2.4.6 and guardrails-ai 0.10.1 on PyPI. The payload runs on install or import and looks for GitHub tokens, npm tokens, CI secrets, and cloud keys. It can republish further packages when the environment is allowed to publish. [CC-4781](https://digital.nhs.uk/cyber-alerts/2026/cc-4781)

TanStack's postmortem is the 11 May slice, and it is narrower than "all of npm." Only the Router and Start repo was affected: 42 packages, two versions each, 84 versions, published between 19:20 and 19:26 UTC. Public detection came about 26 minutes after the first publish. The full set was deprecated about 1 hour 43 minutes after that publish. Query, Table, Form, and the other TanStack families were unaffected. Anyone who installed an affected version on 11 May should rotate AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH credentials reachable from that install host. [Postmortem](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)

## PHP and the Brotli decoder

Microsoft's 26 October guidance says CISA added PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to the KEV catalog on 26 October, and the Brotli decoder flaw (CVE-2026-111497) on 27 October. Treat those two as the runtime patches that jump the queue.

PHP fixed the pair in 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on 21 October. Amazon's MadPot honeypots saw an exploitation attempt on 17 October, four days before the patch. The AWS-specific limit, an ALB web ACL that inspects 8 KB of a body, is in [PHP2Shell on AWS](https://www.bravelo.co/blog/php2shell-aws-waf-8kb-gap-2026/). This page does not repeat that write-up.

> **Field note:** Docker's customer note says the bugs reach PHP back to 5.4, including end-of-life 5.x, 7.x, 8.0, and 8.1, and that updating is the only complete fix. A host left on 8.1 does not get a patch inside 8.1. Move it to one of the four fixed releases, then restart PHP-FPM or the web server. [Docker](https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/)

The 21 October Node.js release is the Brotli fix for Node, not a separate build. Versions 22.23.4, 24.22.1, and 26.12.1 patch CVE-2026-111497, an out-of-bounds write in the bundled decoder. Node.js rates it high. An application is exposed when it decompresses Brotli data an attacker supplies, through `node:zlib` or through a library that does. The same builds fix `dns.resolve` truncating a name at a NUL byte (CVE-2026-105482, high), two TLS hostname checks, a keep-alive response mix-up, and the eMudhra intermediate CA distrust in the bundled certificate store. Node.js 20 and the odd-numbered lines are end of life and receive no build. [Release notes](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)

Python's copy of the eMudhra distrust shipped on 26 October, in 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18. The `ssl` module blocks the compromised intermediate keys, so pip using that interpreter is covered before pip itself is upgraded. The same releases reject links that replace the destination inside `tarfile`'s tar filter (CVE-2026-114583). The 3.13, 3.12, and 3.11 builds are source-only. [Python Insider](https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/)

## Next.js and React

Six of the 27 lines are Next.js or React Server Components. The 3 November Next.js post names 15.5.29 and 16.4.5. I did not diff the July patch commits into those tags. If you are still on 16.2, read the July advisory, then move to a version the later advisory names.

- **26 January, React.** Denial-of-service follow-up in Server Components, [GHSA-83fc-fqcc-2hmg](https://github.com/react/react/security/advisories/GHSA-83fc-fqcc-2hmg). Fixed in 19.0.4, 19.1.5, and 19.2.4. Apps with no server are unaffected.
- **21 July, Next.js.** [15.5.21 and 16.2.11](https://github.com/vercel/next.js/releases/tag/v16.2.11), nine issues. The high ones are Server Action CPU exhaustion (CVE-2026-64641), a middleware bypass on a Turbopack build with a single i18n locale (CVE-2026-64642), and SSRF when a rewrite hostname or a Server Action on a custom server is attacker-controlled. [July release](https://nextjs.org/blog/july-2026-security-release)
- **25 August, Next.js, two criticals.** [15.5.24 and 16.3.3](https://nextjs.org/blog/august-2026-security-release). AVIF image optimization can lead to remote code execution through libheif. Those releases turn AVIF optimization off until the upstream fix lands. CVE-2026-75604 is remote code execution on a Windows filesystem when Pages Router and App Router are both on and Cache Components are off.
- **22 September, Next.js.** [16.3.6](https://nextjs.org/blog/nextjs-security-update-september-22-2026) fixes remote code execution in the Node.js `ImageResponse` (`next/og`) for 16.2.0 up to, and not including, 16.3.6. The Edge implementation is unaffected. 15.5.26 is hardening. Next.js 15 is outside that remote code execution issue.
- **14 October, React and Next.js.** React [GHSA-xqc2-xf4c-x3h3](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3) is unauthenticated remote code execution in a rare path that returns multiple typed arrays. Fixed in 19.0.9, 19.1.10, 19.2.9, and 19.3.1. Next.js [15.5.28 and 16.4.1](https://nextjs.org/blog/nextjs-security-update-october-14-2026) carry that issue through `use cache`, plus image-optimization remote code execution on glibc (a `sharp` build of 0.35.5 or newer is the workaround), plus another Server Action CPU bug.
- **3 November, Next.js.** [15.5.29 and 16.4.5](https://nextjs.org/blog/november-2026-security-release). High: with Cache Components, a cold fill can store one request's `use cache` result for a caller that arrived through `unstable_cache` and does not share the same root parameters. Where those parameters separate tenants, the cached value can be another tenant's data until it is revalidated or evicted.

## Django

Take the 3 November release on the branch you run: 6.1.3, 6.0.10, or 5.2.19. It includes the 6 October fixes on those branches. 4.2 received the 3 February release (4.2.28) and is not in the 3 November set.

- **3 February.** [6.0.2, 5.2.11, and 4.2.28](https://www.djangoproject.com/weblog/2026/feb/03/security-releases/). Repeated headers can exhaust memory under ASGI (CVE-2025-14550). A PostGIS raster lookup is SQL injection when the band index is untrusted (CVE-2026-1207).
- **6 October.** [6.1.2, 6.0.9, and 5.2.18](https://www.djangoproject.com/weblog/2026/oct/06/security-releases/). Long language codes can grow an in-memory cache (low). Quoted header parameters can parse in quadratic time (moderate). Bytes passed into a spatial lookup can make GDAL fetch a remote raster (moderate). Model formsets with an editable primary key can delete or create rows outside the queryset (moderate). A default `BigAutoField` primary key is outside that last bug.
- **3 November.** [Six issues](https://www.djangoproject.com/weblog/2026/nov/03/security-releases/). The moderate pair are server-side request forgery: a GeoJSON `crs` member, and a `SpatialReference` string that GDAL treats as a URL or a file path. Full protection on the string path needs GDAL 3.9 or later. Integer SRIDs do not take that path. The low issues are base64 multipart bodies buffered in memory, geometry values written into logs unescaped, a cache key that treats a missing `Vary` header like an empty one, and, on 6.1 and 6.0 only, a password hash shown to a view-only admin when the user model is custom.

A project that never loads `django.contrib.gis` can ship the November release with the next deploy. A project that stores user-supplied geometry should ship it now. That wait is the trade-off, and it is the wrong wait if GeoDjango is on.

## Docker, nginx, and the rest of 26 October

Docker Desktop 4.97.0, released 26 October, fixes CVE-2026-114409. Desktop versions before 4.97.0 could write third-party API keys and OAuth access tokens in cleartext into local logs and diagnostics bundles. An attacker who can read those files gets the credentials. Docker says the OAuth tokens are not Docker account tokens, that 4.94.0 and 4.95.0 covered the known logging paths, and that 4.97.0 also cleans host logs and crash dumps. A diagnostics bundle you already exported, or a copy of the logs you kept elsewhere, is still sitting wherever you put it. Delete or sanitize those copies. [Announcement](https://docs.docker.com/security/security-announcements/)

Docker Engine 29.9.3 on 3 November fixes five items worth naming. Crafted RSA keys can burn CPU (CVE-2026-116587). Crafted zstd input can panic the daemon (CVE-2026-116591). After firewalld flushes Docker's iptables rules, Swarm overlay networks can lose encryption and spoofing protections (CVE-2026-115538). A worker that already holds a valid worker TLS key can obtain a manager certificate shortly after a Swarm leader change (CVE-2026-115539). BuildKit 0.34.2, shipped in the same release, fixes a git-metadata cache crash and a bug that lets a client with BuildKit API access set extended attributes outside the BuildKit state directory. [Engine 29 notes](https://docs.docker.com/engine/release-notes/29/)

nginx's June fixes landed upstream on 17 June as 1.30.3 stable and 1.31.2 mainline. The public advisory wave is 19 June, which is why that date is on the list. CVE-2026-42530 is a use-after-free in HTTP/3, in 1.31.0 and 1.31.1. CVE-2026-42055 is a heap overflow in the HTTP/2 proxy and gRPC modules. Singapore's CSA scored both 8.1 and described a worker crash, with code execution only if ASLR is off or bypassed. Until you upgrade, turn HTTP/3 off for the first bug. For the second, remove `ignore_invalid_headers off` and keep `large_client_header_buffers` under 2 megabytes. [CSA AL-2026-080](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-080/)

The October nginx bugs shipped upstream on 14 October, in 1.30.6 and 1.31.7. That is alias-plus-rewrite (CVE-2026-15176), script evaluation (CVE-2026-93479), HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), and a use-after-free when SSI runs with asynchronous file I/O (CVE-2026-97205). Ubuntu's USN-8955-1, dated 26 October, packages that 14 October upstream release for Ubuntu. [nginx news](https://nginx.org/2026.html)

## Bugs that depend on a feature you may not use

Vite's 6 April advisories (WebSocket file read, a `server.fs.deny` query bypass, and `.map` path traversal) are fixed in 8.0.5, 7.3.2, and 6.4.2. Each one requires a dev server exposed with `--host` or `server.host`. On 21 October, 6.4.5 fixes a deny bypass that 6.4.4 reintroduced, [GHSA-8g5g-mxqh-grgj](https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj), under the same network condition. A dev server bound to localhost can wait for the next frontend release. Do not publish that port while you wait.

Rails on 29 July shipped 7.2.3.2, 8.0.5.1, and 8.1.3.1 for CVE-2026-66066. The default since `load_defaults 7.0` is libvips for Active Storage variants. An untrusted image upload can then read files the process can read, including the environment, which usually holds `secret_key_base`. You also need libvips 8.13 or newer. Earlier libvips cannot turn the unsafe operations off, and Active Storage raises at boot. After the upgrade, rotate secrets the process could read. An app that does not accept image uploads from users is outside the advisory. [Rails](https://rubyonrails.org/2026/7/29/Rails-Versions-7-2-3-2-8-0-5-1-and-8-1-3-1-have-been-released)

simple-git published four high advisories on 26 September. The command-injection bug covers versions through 3.36.0 and is fixed in 4.0.0. It matters when attacker-controlled data reaches `customArgs` or git's option parser, which is a common shape in CI helpers and hosting panels that accept extra git flags. Upgrade to 4.0.0 or newer. This post does not include a proof of concept. [GHSA-g4wm-2vf7-vfgr](https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr)

Spring Security on 9 June published CVE-2026-41694 and CVE-2026-41003. The first decrypts SAML responses without a valid signature, so a crafted payload can use the service provider as a decryption oracle. The second writes unencoded HTML into forms Spring Security generates, if an attacker can influence `RelyingPartyRegistration`. Open-source fixes are 7.0.6 and 6.5.11. Fixes for 6.4, 6.3, 5.8, and 5.7 are marked Enterprise Support only. [CVE-2026-41694](https://spring.io/security/cve-2026-41694)

On 20 August the open-source fixes are 7.1.1 and 7.0.7. The 6.5 line's matching build, 6.5.12, is Enterprise Support only. A team that stays on public 6.5 artifacts stops at the 9 June release.

- **CVE-2026-59270, critical.** The embedded UnboundID LDAP server registers a well-known admin bind and listens on all interfaces. You are affected if you use `UnboundIdContainer` and the port is reachable. [Advisory](https://spring.io/security/cve-2026-59270)
- **CVE-2026-41707, high.** DPoP proof replay. A flood of dummy requests can evict a legitimate `jti` from a fixed-size cache, and the intercepted proof can then be replayed. [Advisory](https://spring.io/security/cve-2026-41707)
- **CVE-2026-47841, high.** WebAuthn user verification is skipped after a session is serialized, when you set `userVerification` to REQUIRED and you store sessions in Redis, JDBC, or a similar distributed store. The default PREFERRED is outside this bug. [Advisory](https://spring.io/security/cve-2026-47841)
- **CVE-2026-47877, high.** The authorization server's default consent page renders attacker-controlled values without encoding. A custom consent page is unaffected. [Advisory](https://spring.io/security/cve-2026-47877)
- **CVE-2026-47842, medium.** `AesBytesEncryptor` with a null IV uses all-zero AES/CBC, so identical plaintext repeats as identical ciphertext. Spring's migration note says some callers must re-encrypt stored data. [Advisory](https://spring.io/security/cve-2026-47842)
- **CVE-2026-59276.** Security-sensitive comparisons use `String.equals`, so a timing measurement can, in principle, recover a value one character at a time. Spring says a reliable attack over a normal network is difficult. [Advisory](https://spring.io/security/cve-2026-59276)
- **CVE-2026-59277, low, 7.1.0 only.** `InetAddressMatchers` does not treat `0.0.0.0` or `::` as internal. Fixed in 7.1.1. [Advisory](https://spring.io/security/cve-2026-59277)

## What to Do This Week

Do these in order. The lockfile search is first because a framework bump leaves a poisoned install in place. The trade-off is a delayed Django or nginx deploy on apps that do not use the vulnerable feature. A GeoDjango app that stores user geometry, a PHP host, and a Node process that decompresses request bodies do not get that delay.

1. **Search lockfiles.** Run the checker below on every repo and on developer machines. A hit means rotate secrets from a different machine, then install Axios 1.15.2 (1.x) only after plain-crypto-js is gone.
2. **Patch PHP and Node.** Move PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart the workers. Move Node 22, 24, and 26 to 22.23.4, 24.22.1, and 26.12.1. Rebuild container images that bake either runtime in.
3. **Move Next.js to the November versions.** 15.5.29 or 16.4.5, the versions the 3 November post names. If App Router, Server Actions, or `use cache` are on, do this in the same week as Node. Pages Router apps with no server functions can follow the image-optimization notes and schedule the rest.
4. **Schedule everything else.** Django 6.1.3, 6.0.10, or 5.2.19. Docker Desktop 4.97.0, then delete exported diagnostics from 4.96 and earlier. Engine 29.9.3 if you run Swarm or BuildKit. nginx 1.30.6 or 1.31.7. Python builds from 26 October. Spring Security 7.0.7 or 7.1.1 if you are on a public artifact line. simple-git 4.0.0 or newer where git flags come from users. Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 where users upload images, plus libvips 8.13 or newer.

> **Reproduce this** — Save [check-lockfiles.sh](https://www.bravelo.co/examples/architecture-blog-2026/developer-stack-security-2026/check-lockfiles.sh) and run `bash check-lockfiles.sh /path/to/repo`. A clean tree prints `clean: no axios 1.14.1, axios 0.30.4, or plain-crypto-js under /path/to/repo` and exits 0. A lockfile line `axios@1.14.1` is printed and the script exits 1. It reads files only. It does not install packages. The version floors you still compare by hand are in the [README](https://www.bravelo.co/examples/architecture-blog-2026/developer-stack-security-2026/README.md).

Installing through a registry you operate, with a lockfile committed, is the control that would have slowed both malware rows. The steps for CodeArtifact, access keys, and the CloudTrail bucket are in the [4 November lockdown post](https://www.bravelo.co/blog/aws-account-lockdown-november-2026/). This page does not repeat them.

## What This Post Doesn't Cover

We did not reproduce any of these bugs, and we did not measure exploit traffic. F5's commercial nginx products are named in the June CSA alert and are not tabulated here. Brotli in .NET, Git for Windows, and other bundles is on Microsoft's product table, and this page only pins the Node.js builds. The 2 April PyPI incident that shipped malware in litellm and telnyx is outside the 27-date list. The April 16 Axios line is the discovery date described above, not an extra CVE we added. There is no customer story behind the order.

## Sources

- [Axios maintainer postmortem, 31 March 2026](https://github.com/axios/axios/issues/10636)
- [Microsoft, Axios compromise, 1 April 2026](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- [CISA Axios alert, 20 April 2026](https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager)
- [GHSA-3w6x-2g7m-8v23, Axios, published 24 April 2026](https://github.com/advisories/GHSA-3w6x-2g7m-8v23)
- [NHS England Digital CC-4781](https://digital.nhs.uk/cyber-alerts/2026/cc-4781)
- [TanStack npm postmortem, 11 May 2026](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
- [Microsoft, PHP2Shell, Brotli, and eMudhra, October 2026](https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers)
- [Docker on PHP2Shell](https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/)
- [Node.js security releases, 21 October 2026](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [Python Insider, 26 October 2026](https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/)
- [Django, 3 November 2026](https://www.djangoproject.com/weblog/2026/nov/03/security-releases/)
- [Django, 6 October 2026](https://www.djangoproject.com/weblog/2026/oct/06/security-releases/)
- [Django, 3 February 2026](https://www.djangoproject.com/weblog/2026/feb/03/security-releases/)
- [Next.js, 3 November 2026](https://nextjs.org/blog/november-2026-security-release)
- [Next.js, 14 October 2026](https://nextjs.org/blog/nextjs-security-update-october-14-2026)
- [Next.js, 22 September 2026](https://nextjs.org/blog/nextjs-security-update-september-22-2026)
- [Next.js, August 2026](https://nextjs.org/blog/august-2026-security-release)
- [Next.js v16.2.11, published 21 July 2026](https://github.com/vercel/next.js/releases/tag/v16.2.11)
- [Docker security announcements](https://docs.docker.com/security/security-announcements/)
- [Docker Engine 29 release notes](https://docs.docker.com/engine/release-notes/29/)
- [nginx news, 2026](https://nginx.org/2026.html)
- [CSA Singapore AL-2026-080, 19 June 2026](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-080/)
- [Rails security releases, 29 July 2026](https://rubyonrails.org/2026/7/29/Rails-Versions-7-2-3-2-8-0-5-1-and-8-1-3-1-have-been-released)
- [Spring Security CVE-2026-59270](https://spring.io/security/cve-2026-59270)
- [Spring Security CVE-2026-41694](https://spring.io/security/cve-2026-41694)

## FAQ

### When should we not treat the 3 November Django release as an outage?
When the project does not use GeoDjango and does not pass user input into spatial lookups, SpatialReference, or geometry fields. The two moderate issues on 3 November are server-side request forgery through GDAL. The other four are low in Django's own rating. Ship 6.1.3, 6.0.10, or 5.2.19 on the next release. A project that saves user-supplied geometry should take that release now.

### What goes wrong if we only bump the framework and leave the lockfile?
Axios 1.14.1 and 0.30.4 ran code at install time. A later Next.js or Django version does not remove plain-crypto-js, and it does not rotate the tokens that install already read. Search the lockfile and node_modules, delete the bad copies, and rotate secrets from a machine that never installed those versions.

### Does the Vite advisory apply when the dev server listens on localhost?
The 6 April and 21 October Vite advisories apply when the dev server is exposed to the network, with --host or server.host. A server bound only to localhost is outside those conditions. Still move to 6.4.5, 7.3.2, or 8.0.5 before anyone publishes the dev port.

### Does the 25 August Next.js Windows issue apply on Linux?
CVE-2026-75604 applies when the Next.js server uses a Windows filesystem, with both the Pages Router and the App Router, and without Cache Components. Linux and macOS hosts are outside that bug. The AVIF image-optimization issue shipped the same day is separate, and the 25 August releases disable AVIF optimization until libheif is safe.

### We are on Axios 1.14.0. Which version should we install now?
1.14.0 is the maintainer's safe pin for the 31 March malware. Advisories published on 24 April move the 1.x floor to 1.15.2, which fixes CVE-2026-42044. Install 1.15.2 from a clean machine. On the 0.x line, skip 0.30.4. Several 24 April advisories name 0.31.1. Read GHSA-3w6x-2g7m-8v23 before you stay on 0.x.

### Is there a patch for PHP 8.1?
No fixed release on the 8.1 line, or on 8.0, 7.x, or 5.x. Docker's customer note says those lines are affected back to PHP 5.4, and that updating is the only complete fix. Move the host to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, then restart PHP-FPM or the web server.

---

*Source: https://www.bravelo.co/blog/developer-stack-security-2026/*