The framework this site runs on is today's headline. Next.js ships its July 2026 security release — nine advisories in one drop, all fixed in 15.5.21 and 16.2.11 — led by a middleware/proxy auth bypass (8.3) and two server-side-request-forgery highs, with cache-confusion and denial-of-service moderates underneath. It's the framework behind a large share of LLM chat UIs and full-stack RAG frontends, so if you serve one, that's this morning's upgrade. Below it, JupyterLab closes two code-execution highs (4.5.10 / 4.6.2), and n8n patches a moderate that leaks LLM-node credential headers into the execution log. Everything here has a fixed release.

Worth your morning

Next.js — the monthly release, a heavier one. The July drop bundles nine advisories; two to read first. CVE-2026-64642 (8.3) is a middleware/proxy auth bypass in App Router apps built with Turbopack that carry a single i18n.locales entry — meaning middleware-enforced auth can be skipped on those routes. CVE-2026-64645 (8.3) covers a rewrites() or redirects() rule that builds its destination hostname from request input, which can be aimed at an arbitrary host — SSRF for rewrites, open redirect for redirects. A companion SSRF in Server Actions on custom servers (CVE-2026-64649) and a set of cache-confusion and App-Router DoS moderates fill out the release. All of it closes in 15.5.21 and 16.2.11, and older 15.x/16.x minors won't be back-patched — the fix is moving to the patched minor, not cherry-picking onto your own. If your app is an LLM UI or RAG frontend on Next.js, that's today's version check.

JupyterLab — two highs in the notebook. GHSA-pppj-hq3g-57pj (8.6) lets a crafted overrides.json settings file run code with the user's privileges when it's imported — enough to read or change that user's notebooks and files. GHSA-gx64-gj6p-pc4c (7.5) reaches code execution when a malicious image is opened in the image viewer. Two moderates ride along: a PyPI extension-blocklist bypass and a PluginManager lock-rule bypass. 4.5.10 (on the 4.5 line) and 4.6.2 clear all four. If your team runs shared or internet-adjacent Jupyter, upgrade and treat settings files and notebooks from outside as untrusted input.

n8n — the credential that ends up in the log. CVE-2026-65589 (5.1) is moderate but on-point for anyone wiring LLM calls through n8n: API keys and secrets set as custom HTTP headers on an LLM-node credential are stored in plaintext in the execution data any authenticated user can open. Fixed in 1.123.64, 2.29.8, and 2.30.1 — upgrade, and rotate any key that sat in one of those headers. The same July batch also fixes SQL injection in the Snowflake and Postgres nodes and a cross-tenant cache-poisoning issue, all moderate.

Still quiet on the .NET, NuGet, Azure, PrimeNG, and Angular side — nothing new has cleared the bar since July's servicing release on the 14th.