The reviewed databases came back yesterday and emptied the queue: roughly fifty npm and pip advisories, nearly all of them carrying an August publication date and a September 8 review date. Almost nothing in it happened this week. What it does surface is two Next.js criticals from August 25 — a 9.5 and a 9.0, both unauthenticated remote code execution — that this digest has never printed, and GitPython at 9.3. The only thing that actually landed yesterday is Microsoft's September cycle, which brings six .NET advisories and moves the runtime floor.

Worth your morning

Next.js — two criticals, fixed on August 25, and nobody told your scanner until yesterday. GHSA-2xp9-vwfh-vxw4 scores 9.5 under CVSS 4.0 and carries no CVE. The defect is not in Next.js — it is a heap buffer overflow in libheif, reached through sharp, reached through the Image Optimization API whenever an attacker-supplied AVIF file gets optimized. Affected is everything from 10.0.0 below 15.5.24, and 16.0 below 16.3.3.

Read the fix before you assume it is one. The patched releases do not fix AVIF decoding; they turn it off and wait for libheif. If your application serves AVIF through the optimizer, upgrading changes what it does.

Alongside it, CVE-2026-75604 scores 9.0 and is path traversal reaching code execution on Windows-hosted servers running Pages or App Router without Cache Component. Affected is 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2. The advisory states there is no workaround for Windows deployments. Both close in the same pair of releases — 15.5.24 on the maintenance line, 16.3.3 on the active one. Applications on Vercel were never exposed to either.

This digest covers Next.js because a large share of LLM chat interfaces and RAG frontends sit on it, which was the stated reason back in July when the framework's monthly batch led a morning. The July items were caught the day they published. These two sat for fourteen days, because the vendor advisory and the reviewed npm record are different events and only the second one reaches a dependency scanner.

.NET — the September batch, and the floor moves. Six advisories in dotnet/announcements, all dated September 8. Two are the same 8.8 heap overflow in Microsoft.DiaSymReader.Native while processing PDB files, reported as CVE-2026-71328 and CVE-2026-69522; the second also reaches .NET Framework. Affected is 17.10.0-beta1.24272.1 through 18.9.0-beta1.26405.1, fixed in 18.9.0-beta1.26405.2, Windows only.

CVE-2026-69304 (5.9) is the one that moves your runtime version: the ASP.NET Core IIS middleware mishandles request-decompression limits and burns memory, affecting out-of-process IIS hosting. Fixed versions are 8.0.31, 9.0.20 and 10.0.12 — the August floor of 8.0.30 / 9.0.19 / 10.0.11 is superseded. CVE-2026-69806 (7.0) is Linux-only and lands in the SDK rather than the runtime: dotnet-watch exposes arguments to the Aspire server service, fixed in SDK 9.0.317, 10.0.111 and 10.0.400. CVE-2026-58649 is information disclosure across 8.0 through 11.0.

The wider cycle is large — Tenable counts 964 CVEs with two exploited zero-days, CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in ALPC, both local privilege escalation to SYSTEM. Neither is a .NET or Azure item, but both are on the Windows hosts your .NET runs on. Azure Arc, CycleCloud, HDInsights, Attestation and the Azure CLI all take patches this month without individually named CVEs in the summary coverage.

GitPython — a config value that is inert until something else writes the file. CVE-2026-78676 scores 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) under CWE-88 and CWE-94. GitConfigParser mishandles legitimately encoded multi-line configuration values, so an unrelated write operation rewrites them into live directives — core.hooksPath among them, which is how it reaches code execution. Affected is 3.1.58 and below, fixed in 3.1.59, published August 10.

Four more GitPython advisories reviewed alongside it, all in the same shape of a guard that does not cover everything it is documented to cover: CVE-2026-78675 (high, [include] directive reading arbitrary files), CVE-2026-78677 (high, clone() omitting --separate-git-dir from its unsafe-options list), plus two moderates on the revision-options denylist and TagReference.create. GitPython sits in the dependency tree of a great deal of agent and MLOps tooling that clones repositories on someone else's behalf, which is the population that should care.

winml-cli — localhost is not an access control. CVE-2026-84452 scores 8.6. Microsoft's Windows ML command-line tool binds to localhost and then sets allow_origins to a wildcard, so any page in the operator's browser can reach the endpoint, and parameter validation on the flags behind it is thin. Affected is everything below 0.4.0, fixed there, published August 28. A local bind stops the network and does not stop a browser tab.

What the flush actually means

Yesterday's digest read four days of silence as the AI stack's advisories migrating to repository-level records that dependency tooling cannot see. Half of that stands — Ollama and llama.cpp are still repo-only, and that is still why they went unnoticed for months. But the silence itself was a review queue, not an absence. Every headline item in today's table has an August publication date and a September 8 review date: NLTK's two criticals published August 11, GitPython's on the 10th, Next.js on the 25th, winml-cli on the 28th.

Two consequences worth holding. A scanner that keys on review date will raise criticals at you this morning that were fixed a month ago and that, for NLTK and vLLM, you already patched on this digest's advice — the NLTK pair closes at 3.10.3, the standing floor since August, and vLLM's SSRF closes at 0.26.0, well under the 0.28.0 floor. Neither needs an action. The gap runs the other way for anything the queue had not reached: the Next.js criticals were public, fixed and unremarked for fourteen days while the reviewed feed said nothing.

Standing items

Milvus, day twenty-nine. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open with one approval of two, Code-Check still failing, no activity since August 14 — twenty-six days. Port 9091 stays firewalled.

Ollama. Corrected yesterday and unchanged: five highs and a low on the record, 0.33.3 is the version to be on, and none of it appears in the reviewed feeds.

.NET supersedes. The standing 8.0.30 / 9.0.19 / 10.0.11 line is replaced by 8.0.31 / 9.0.20 / 10.0.12, with SDK 9.0.317 / 10.0.111 / 10.0.400 on Linux.

Carried unchanged from September 8: knowns wants 0.30.0 as the floor with 0.33.0 current and the outbound-fetch item still unfixed on it, llama.cpp's RPC server has no fix and wants a loopback bind, Open WebUI wants 0.11.1 as the floor with 0.11.3 current, OpenMAIC wants 1.0.1, Bifrost wants transports/v2.0.0 or management auth on, nbviewer is commit-only with no release, rowboat has no fix and wants egress rules, openagents is vendor-declined, codewhale wants 0.8.64 with the cargo deepseek-tui crate still unfixed, vLLM wants 0.28.0, @typespec/spector wants 0.1.0-alpha.27, unstructured wants 0.24.0, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major.

Feed notes. Angular is unchanged at 22.1.5 from September 3, still with no security designation. PrimeNG has shipped nothing since 21.1.9 in June and remains security-fix-only. NuGet's own feed has published nothing since the low-severity Magick.NET memory leak on September 2 — this month's .NET items arrive through dotnet/announcements and MSRC rather than as package advisories.

Filtered out and why. The npm half of the flush was general web infrastructure rather than either tracked stack: four multer denial-of-service items, four Nodemailer address-parsing and allowlist-bypass advisories, three xmldom well-formedness bypasses, three Hono moderates, two SVGO sanitizer bypasses, js-yaml, Tiptap, morgan and sharp's own libheif row. Astro's critical shares the exact AVIF root cause with the Next.js item and is out of scope only because nothing on either stack runs it — if you have an Astro site elsewhere, it wants the same attention. On the pip side, five HTTPX2 advisories were checked and dropped: it is a separate package rather than the httpx that sits under the OpenAI and Anthropic Python SDKs, and the name is close enough to be worth stating out loud. Prowler's stored-XSS moderate and the fourteen remaining NLTK backfill rows below critical are real and change no action.