Patch the 2026 developer stack in this order

On 3 November 2026, Django, Next.js, and Docker Engine each shipped a security release. Those three sit at the end of a working list of 27 dates, from the 26 January React Server Components update through that morning. Two dates were malware placed in packages people already install. The others were vulnerability fixes, and several apply only when you use a named feature.

There is no client silhouette in this post. Counts and versions come from the vendor and government pages linked below. We did not run the payloads.

The same pages support the four figures below.

from 26 January through 3 November 2026.

27 dates

on npm for Axios 1.14.1 and 0.30.4.

~3 hours

in the 3 November Django release.

6 CVEs

TanStack published in six minutes on 11 May.

84 versions

Malware in packages you already install

A version bump on a clean laptop does not clean a laptop that already ran the bad install. The payload runs when the package manager installs or updates.

Axios on 31 March

Microsoft’s 1 April write-up says axios@1.14.1 and axios@0.30.4 pulled in plain-crypto-js@4.2.1, which downloaded a remote access trojan for macOS, Windows, and Linux. The maintainer’s postmortem says the npm account was the lead maintainer’s, reached through social engineering, and that the malicious versions were live for about 3 hours.

The maintainer names the network indicators sfrclak[.]com and 142.11.206.73 on port 8000. Microsoft’s write-up names 142.11.206[.]72 on the same port. Search for both. CISA’s alert is dated 20 April and describes this same 31 March publish.

The 16 April mark on the working list is a discovery date inside advisories GitHub published on 24 April. CVE-2026-42044’s timeline says the issue was found on 16 April and the proof was checked the same day. The advisory itself is dated 24 April, and the patched 1.x release it names is 1.15.2. Sibling advisories that day, including a no_proxy gap, name 1.15.1 and 0.31.1. There was no second malicious Axios publish on 16 April. Install 1.15.2 on the 1.x line after the machine is clean. GHSA-3w6x-2g7m-8v23

npm and PyPI from 29 April to 11 May

NHS England Digital alert CC-4781 calls this wave Mini Shai-Hulud. It dates malicious uploads to 29 April and 11 May 2026. The alert names TanStack, Mistral AI, UiPath, and OpenSearch on npm, and mistralai 2.4.6 and guardrails-ai 0.10.1 on PyPI. The payload runs on install or import and looks for GitHub tokens, npm tokens, CI secrets, and cloud keys. It can republish further packages when the environment is allowed to publish. CC-4781

TanStack’s postmortem is the 11 May slice, and it is narrower than “all of npm.” Only the Router and Start repo was affected: 42 packages, two versions each, 84 versions, published between 19:20 and 19:26 UTC. Public detection came about 26 minutes after the first publish. The full set was deprecated about 1 hour 43 minutes after that publish. Query, Table, Form, and the other TanStack families were unaffected. Anyone who installed an affected version on 11 May should rotate AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH credentials reachable from that install host. Postmortem

PHP and the Brotli decoder

Microsoft’s 26 October guidance says CISA added PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to the KEV catalog on 26 October, and the Brotli decoder flaw (CVE-2026-111497) on 27 October. Treat those two as the runtime patches that jump the queue.

PHP fixed the pair in 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on 21 October. Amazon’s MadPot honeypots saw an exploitation attempt on 17 October, four days before the patch. The AWS-specific limit, an ALB web ACL that inspects 8 KB of a body, is in PHP2Shell on AWS. This page does not repeat that write-up.

The 21 October Node.js release is the Brotli fix for Node, not a separate build. Versions 22.23.4, 24.22.1, and 26.12.1 patch CVE-2026-111497, an out-of-bounds write in the bundled decoder. Node.js rates it high. An application is exposed when it decompresses Brotli data an attacker supplies, through node:zlib or through a library that does. The same builds fix dns.resolve truncating a name at a NUL byte (CVE-2026-105482, high), two TLS hostname checks, a keep-alive response mix-up, and the eMudhra intermediate CA distrust in the bundled certificate store. Node.js 20 and the odd-numbered lines are end of life and receive no build. Release notes

Python’s copy of the eMudhra distrust shipped on 26 October, in 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18. The ssl module blocks the compromised intermediate keys, so pip using that interpreter is covered before pip itself is upgraded. The same releases reject links that replace the destination inside tarfile’s tar filter (CVE-2026-114583). The 3.13, 3.12, and 3.11 builds are source-only. Python Insider

Next.js and React

Six of the 27 lines are Next.js or React Server Components. The 3 November Next.js post names 15.5.29 and 16.4.5. I did not diff the July patch commits into those tags. If you are still on 16.2, read the July advisory, then move to a version the later advisory names.

• 26 January, React. Denial-of-service follow-up in Server Components, GHSA-83fc-fqcc-2hmg. Fixed in 19.0.4, 19.1.5, and 19.2.4. Apps with no server are unaffected.
• 21 July, Next.js. 15.5.21 and 16.2.11, nine issues. The high ones are Server Action CPU exhaustion (CVE-2026-64641), a middleware bypass on a Turbopack build with a single i18n locale (CVE-2026-64642), and SSRF when a rewrite hostname or a Server Action on a custom server is attacker-controlled. July release
• 25 August, Next.js, two criticals. 15.5.24 and 16.3.3. AVIF image optimization can lead to remote code execution through libheif. Those releases turn AVIF optimization off until the upstream fix lands. CVE-2026-75604 is remote code execution on a Windows filesystem when Pages Router and App Router are both on and Cache Components are off.
• 22 September, Next.js. 16.3.6 fixes remote code execution in the Node.js ImageResponse (next/og) for 16.2.0 up to, and not including, 16.3.6. The Edge implementation is unaffected. 15.5.26 is hardening. Next.js 15 is outside that remote code execution issue.
• 14 October, React and Next.js. React GHSA-xqc2-xf4c-x3h3 is unauthenticated remote code execution in a rare path that returns multiple typed arrays. Fixed in 19.0.9, 19.1.10, 19.2.9, and 19.3.1. Next.js 15.5.28 and 16.4.1 carry that issue through use cache, plus image-optimization remote code execution on glibc (a sharp build of 0.35.5 or newer is the workaround), plus another Server Action CPU bug.
• 3 November, Next.js. 15.5.29 and 16.4.5. High: with Cache Components, a cold fill can store one request’s use cache result for a caller that arrived through unstable_cache and does not share the same root parameters. Where those parameters separate tenants, the cached value can be another tenant’s data until it is revalidated or evicted.

Django

Take the 3 November release on the branch you run: 6.1.3, 6.0.10, or 5.2.19. It includes the 6 October fixes on those branches. 4.2 received the 3 February release (4.2.28) and is not in the 3 November set.

• 3 February. 6.0.2, 5.2.11, and 4.2.28. Repeated headers can exhaust memory under ASGI (CVE-2025-14550). A PostGIS raster lookup is SQL injection when the band index is untrusted (CVE-2026-1207).
• 6 October. 6.1.2, 6.0.9, and 5.2.18. Long language codes can grow an in-memory cache (low). Quoted header parameters can parse in quadratic time (moderate). Bytes passed into a spatial lookup can make GDAL fetch a remote raster (moderate). Model formsets with an editable primary key can delete or create rows outside the queryset (moderate). A default BigAutoField primary key is outside that last bug.
• 3 November. Six issues. The moderate pair are server-side request forgery: a GeoJSON crs member, and a SpatialReference string that GDAL treats as a URL or a file path. Full protection on the string path needs GDAL 3.9 or later. Integer SRIDs do not take that path. The low issues are base64 multipart bodies buffered in memory, geometry values written into logs unescaped, a cache key that treats a missing Vary header like an empty one, and, on 6.1 and 6.0 only, a password hash shown to a view-only admin when the user model is custom.

A project that never loads django.contrib.gis can ship the November release with the next deploy. A project that stores user-supplied geometry should ship it now. That wait is the trade-off, and it is the wrong wait if GeoDjango is on.

Docker, nginx, and the rest of 26 October

Docker Desktop 4.97.0, released 26 October, fixes CVE-2026-114409. Desktop versions before 4.97.0 could write third-party API keys and OAuth access tokens in cleartext into local logs and diagnostics bundles. An attacker who can read those files gets the credentials. Docker says the OAuth tokens are not Docker account tokens, that 4.94.0 and 4.95.0 covered the known logging paths, and that 4.97.0 also cleans host logs and crash dumps. A diagnostics bundle you already exported, or a copy of the logs you kept elsewhere, is still sitting wherever you put it. Delete or sanitize those copies. Announcement

Docker Engine 29.9.3 on 3 November fixes five items worth naming. Crafted RSA keys can burn CPU (CVE-2026-116587). Crafted zstd input can panic the daemon (CVE-2026-116591). After firewalld flushes Docker’s iptables rules, Swarm overlay networks can lose encryption and spoofing protections (CVE-2026-115538). A worker that already holds a valid worker TLS key can obtain a manager certificate shortly after a Swarm leader change (CVE-2026-115539). BuildKit 0.34.2, shipped in the same release, fixes a git-metadata cache crash and a bug that lets a client with BuildKit API access set extended attributes outside the BuildKit state directory. Engine 29 notes

nginx’s June fixes landed upstream on 17 June as 1.30.3 stable and 1.31.2 mainline. The public advisory wave is 19 June, which is why that date is on the list. CVE-2026-42530 is a use-after-free in HTTP/3, in 1.31.0 and 1.31.1. CVE-2026-42055 is a heap overflow in the HTTP/2 proxy and gRPC modules. Singapore’s CSA scored both 8.1 and described a worker crash, with code execution only if ASLR is off or bypassed. Until you upgrade, turn HTTP/3 off for the first bug. For the second, remove ignore_invalid_headers off and keep large_client_header_buffers under 2 megabytes. CSA AL-2026-080

The October nginx bugs shipped upstream on 14 October, in 1.30.6 and 1.31.7. That is alias-plus-rewrite (CVE-2026-15176), script evaluation (CVE-2026-93479), HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), and a use-after-free when SSI runs with asynchronous file I/O (CVE-2026-97205). Ubuntu’s USN-8955-1, dated 26 October, packages that 14 October upstream release for Ubuntu. nginx news

Bugs that depend on a feature you may not use

Vite’s 6 April advisories (WebSocket file read, a server.fs.deny query bypass, and .map path traversal) are fixed in 8.0.5, 7.3.2, and 6.4.2. Each one requires a dev server exposed with --host or server.host. On 21 October, 6.4.5 fixes a deny bypass that 6.4.4 reintroduced, GHSA-8g5g-mxqh-grgj, under the same network condition. A dev server bound to localhost can wait for the next frontend release. Do not publish that port while you wait.

Rails on 29 July shipped 7.2.3.2, 8.0.5.1, and 8.1.3.1 for CVE-2026-66066. The default since load_defaults 7.0 is libvips for Active Storage variants. An untrusted image upload can then read files the process can read, including the environment, which usually holds secret_key_base. You also need libvips 8.13 or newer. Earlier libvips cannot turn the unsafe operations off, and Active Storage raises at boot. After the upgrade, rotate secrets the process could read. An app that does not accept image uploads from users is outside the advisory. Rails

simple-git published four high advisories on 26 September. The command-injection bug covers versions through 3.36.0 and is fixed in 4.0.0. It matters when attacker-controlled data reaches customArgs or git’s option parser, which is a common shape in CI helpers and hosting panels that accept extra git flags. Upgrade to 4.0.0 or newer. This post does not include a proof of concept. GHSA-g4wm-2vf7-vfgr

Spring Security on 9 June published CVE-2026-41694 and CVE-2026-41003. The first decrypts SAML responses without a valid signature, so a crafted payload can use the service provider as a decryption oracle. The second writes unencoded HTML into forms Spring Security generates, if an attacker can influence RelyingPartyRegistration. Open-source fixes are 7.0.6 and 6.5.11. Fixes for 6.4, 6.3, 5.8, and 5.7 are marked Enterprise Support only. CVE-2026-41694

On 20 August the open-source fixes are 7.1.1 and 7.0.7. The 6.5 line’s matching build, 6.5.12, is Enterprise Support only. A team that stays on public 6.5 artifacts stops at the 9 June release.

• CVE-2026-59270, critical. The embedded UnboundID LDAP server registers a well-known admin bind and listens on all interfaces. You are affected if you use UnboundIdContainer and the port is reachable. Advisory
• CVE-2026-41707, high. DPoP proof replay. A flood of dummy requests can evict a legitimate jti from a fixed-size cache, and the intercepted proof can then be replayed. Advisory
• CVE-2026-47841, high. WebAuthn user verification is skipped after a session is serialized, when you set userVerification to REQUIRED and you store sessions in Redis, JDBC, or a similar distributed store. The default PREFERRED is outside this bug. Advisory
• CVE-2026-47877, high. The authorization server’s default consent page renders attacker-controlled values without encoding. A custom consent page is unaffected. Advisory
• CVE-2026-47842, medium. AesBytesEncryptor with a null IV uses all-zero AES/CBC, so identical plaintext repeats as identical ciphertext. Spring’s migration note says some callers must re-encrypt stored data. Advisory
• CVE-2026-59276. Security-sensitive comparisons use String.equals, so a timing measurement can, in principle, recover a value one character at a time. Spring says a reliable attack over a normal network is difficult. Advisory
• CVE-2026-59277, low, 7.1.0 only. InetAddressMatchers does not treat 0.0.0.0 or :: as internal. Fixed in 7.1.1. Advisory

What to Do This Week

Do these in order. The lockfile search is first because a framework bump leaves a poisoned install in place. The trade-off is a delayed Django or nginx deploy on apps that do not use the vulnerable feature. A GeoDjango app that stores user geometry, a PHP host, and a Node process that decompresses request bodies do not get that delay.

1. Search lockfiles. Run the checker below on every repo and on developer machines. A hit means rotate secrets from a different machine, then install Axios 1.15.2 (1.x) only after plain-crypto-js is gone.
2. Patch PHP and Node. Move PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart the workers. Move Node 22, 24, and 26 to 22.23.4, 24.22.1, and 26.12.1. Rebuild container images that bake either runtime in.
3. Move Next.js to the November versions. 15.5.29 or 16.4.5, the versions the 3 November post names. If App Router, Server Actions, or use cache are on, do this in the same week as Node. Pages Router apps with no server functions can follow the image-optimization notes and schedule the rest.
4. Schedule everything else. Django 6.1.3, 6.0.10, or 5.2.19. Docker Desktop 4.97.0, then delete exported diagnostics from 4.96 and earlier. Engine 29.9.3 if you run Swarm or BuildKit. nginx 1.30.6 or 1.31.7. Python builds from 26 October. Spring Security 7.0.7 or 7.1.1 if you are on a public artifact line. simple-git 4.0.0 or newer where git flags come from users. Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 where users upload images, plus libvips 8.13 or newer.

Installing through a registry you operate, with a lockfile committed, is the control that would have slowed both malware rows. The steps for CodeArtifact, access keys, and the CloudTrail bucket are in the 4 November lockdown post. This page does not repeat them.

What This Post Doesn’t Cover

We did not reproduce any of these bugs, and we did not measure exploit traffic. F5’s commercial nginx products are named in the June CSA alert and are not tabulated here. Brotli in .NET, Git for Windows, and other bundles is on Microsoft’s product table, and this page only pins the Node.js builds. The 2 April PyPI incident that shipped malware in litellm and telnyx is outside the 27-date list. The April 16 Axios line is the discovery date described above, not an extra CVE we added. There is no customer story behind the order.

Sources

• Axios maintainer postmortem, 31 March 2026
• Microsoft, Axios compromise, 1 April 2026
• CISA Axios alert, 20 April 2026
• GHSA-3w6x-2g7m-8v23, Axios, published 24 April 2026
• NHS England Digital CC-4781
• TanStack npm postmortem, 11 May 2026
• Microsoft, PHP2Shell, Brotli, and eMudhra, October 2026
• Docker on PHP2Shell
• Node.js security releases, 21 October 2026
• Python Insider, 26 October 2026
• Django, 3 November 2026
• Django, 6 October 2026
• Django, 3 February 2026
• Next.js, 3 November 2026
• Next.js, 14 October 2026
• Next.js, 22 September 2026
• Next.js, August 2026
• Next.js v16.2.11, published 21 July 2026
• Docker security announcements
• Docker Engine 29 release notes
• nginx news, 2026
• CSA Singapore AL-2026-080, 19 June 2026
• Rails security releases, 29 July 2026
• Spring Security CVE-2026-59270
• Spring Security CVE-2026-41694

Frequently asked questions