Patch this week:Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026). Teams self-hosting Next.js 13.4+ on Windows, anyone serving the built-in Image Optimization API (next start, standalone, containers) on Next.js 10 through 16.3.2, and Next.js 16.2+ apps that put request data into Node.js next/og images.
Patch this week:Apache Tomcat August 2026: Security Constraint Bypasses. Anyone running Tomcat 9.0, 10.1 or 11.0, standalone or embedded, that relies on declarative security constraints, FORM or DIGEST authentication, CLIENT-CERT or SPNEGO with DataSourceRealm or JDBCRealm, or RewriteValve rules for access control.
Do you run any of these? Gitea Gitea. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-28.
PyPI: 4 critical advisories (chainlit, qwed-mcp, nextcloud-mcp-server, PraisonAI). Check with pip-audit (or: pip show <package>).
Self-hosted Next.js apps still below 15.5.24 or 16.3.3 should upgrade now, ideally straight to the October releases; Windows hosts and apps optimizing untrusted AVIF images are the urgent cases.
Must act: Teams self-hosting Next.js 13.4+ on Windows, anyone serving the built-in Image Optimization API (next start, standalone, containers) on Next.js 10 through 16.3.2, and Next.js 16.2+ apps that put request data into Node.js next/og images.
Can relax: Netlify-hosted sites (Netlify says neither August bug reaches its platform), static exports with no Next.js server, Linux or macOS hosts for the Windows bug, and Edge-runtime ImageResponse users for the next/og bug.
Run npm ls next sharp satori in every Next.js service and note which ones are self-hosted.
Upgrade: npm install next@15.5.28 or next@16.4.1 (minimums for these bugs: 15.5.24, 16.3.3, and 16.3.6 for next/og), then rebuild and redeploy.
On Windows hosts, treat any unpatched, internet-facing server as possibly exposed: rebuild, and rotate NEXT_SERVER_ACTIONS_ENCRYPTION_KEY if you pin it.
Upgrade Tomcat, including the copy embedded in Spring Boot apps, this week; the access-control bypasses matter wherever you rely on web.xml security constraints or container authentication, and none is known to be exploited.
Must act: Anyone running Tomcat 9.0, 10.1 or 11.0, standalone or embedded, that relies on declarative security constraints, FORM or DIGEST authentication, CLIENT-CERT or SPNEGO with DataSourceRealm or JDBCRealm, or RewriteValve rules for access control.
Can relax: Applications that enforce authorization in their own code rather than in Tomcat security constraints, and that use none of the affected authenticators or the RewriteValve, have little exposure and can patch on a normal cycle.
Find every Tomcat, including tomcat-embed-core inside Spring Boot and other fat JARs, and record its version.
Upgrade standalone servers to 11.0.25, 10.1.59 or 9.0.121 or later and restart.
For Spring Boot apps, override the managed Tomcat version (Maven property tomcat.version) to a fixed release, rebuild and redeploy; the latest Boot releases still ship 11.0.24.