Next.js shipped 15.5.28 and 16.4.1 yesterday evening with two critical advisories. One is a new unauthenticated code-execution flaw in use cache functions on 16.x. The other is Next.js's own record for the sharp SVG bug covered on October 7, and on 15.x the upgrade alone may not pull in the fixed sharp. n8n, the GitLab MCP server and ToolHive each fixed a batch of advisories, and the Portkey AI Gateway has an SSRF with no fixed release.

All 34 repository advisories behind these rows return 404 in GitHub's database, so npm audit, Dependabot and pip-audit raise none of them yet. The exception that helps is sharp: its own record has been in the database since October 6, so scanners still flag sharp below 0.35.5 in a Next.js lockfile. Portkey's record is an unreviewed CVE with no package mapping.

Worth your morning

Next.js: two 9.5s and a fix that may leave sharp behind. GHSA-673q (9.5 on v4, no CVE yet) affects App Router applications that use Cache Components on 16.0 through 16.4.0. A use cache function that returns multiple typed arrays can lead to code execution with no login. Vercel lists no workaround and says to upgrade even if no function in your app looks like that. 15.x isn't affected by this one.

GHSA-2464 (9.5 on v4) carries CVE-2026-96889, the librsvg memory bug in sharp that can lead to code execution through the Image Optimization API on glibc-based Linux. The sharp record rates it 8.9; Next.js's record covers every release from 10.0.0 through 15.5.27 and 16.0 through 16.4.0. The fix is sharp 0.35.5, and that is where the two release lines differ. 16.4.1 declares sharp ^0.35.5. 15.5.28 declares ^0.34.3 || ^0.35.5, and sharp 0.34 has no fixed release, so a project whose lockfile already holds sharp 0.34.x keeps it after the upgrade. The fix for 15.x widens the range to include the fixed sharp without removing the unfixed one. Run npm ls sharp after upgrading. sharp 0.35 needs Node 20.9 or later. Next.js 14 and older get no release, so the advisory's workaround, sharp 0.35.5 or later, is the only route there.

The third record, GHSA-p3m5 (8.2 on v4), lets crafted requests tie up a process's CPU in any App Router app with at least one Server Action, from 13.0.0 on. Pages Router apps and apps without Server Actions aren't affected.

n8n: fifteen more, two weeks after the last fifteen. n8n published 15 advisories at 09:34–09:44 UTC yesterday, one to two hours after 2.44.1, 2.43.5 and 1.123.85 reached npm. The top one (GHSA-mp7q, 8.4 on v4): some webhook responses, including error responses, went out without n8n's sandbox Content-Security-Policy, so a member who can create and activate workflows could serve a page that runs with the session of another user who opens the webhook URL. A crafted workflow ID gave members read and write access to Data Table rows in every project (GHSA-wvjj, 7.2), and two denial-of-service flaws score 7.1 each. Among the medium ones, a Slack Trigger webhook flaw (GHSA-3c3p, 6.3) needs no login and was already fixed in 2.41.4, 2.42.1 and 1.123.83, the releases behind the batch covered on October 1. Take 2.43.5, the current stable, or 2.44.1. On the 1.x line, npm publishes 1.123.85 under the rc tag, so name the version when you install it.

GitLab MCP server: seven fixes overnight, one OAuth setting to change. @zereight/mcp-gitlab (140,000 downloads a week) released 2.2.6 at 18:49 UTC yesterday for a project-scope authorization bypass affecting 2.1.58 onward (GHSA-qcj2, 8.1). 2.3.0 followed at 00:56 UTC today with seven more. The worst (GHSA-5w3p, 8.1) lets any client that registers with the server's OAuth callback proxy receive a victim's GitLab tokens. 2.3.0 adds a consent page and an allowlist of client callback URLs, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS, whose default covers the Claude, ChatGPT and Cursor callbacks and loopback. download_attachment could overwrite files in the working directory even in read-only mode (7.5), and downloads now go to a dedicated GITLAB_DOWNLOAD_DIR. The local OAuth callback server handed tokens to any local caller (6.6). If your deployment ran GITLAB_OAUTH_CALLBACK_PROXY where clients you don't control could register, revoke the GitLab tokens it issued. The package's floor moves from 2.1.65, set on September 24, to 2.3.0.

Portkey AI Gateway: an SSRF in the default trust list, no fix. VulnCheck filed CVE-2026-110719 (7.2; 6.9 on v4) yesterday against Portkey's open-source gateway (13,000 GitHub stars), 1.14.0 through 1.15.2. When TRUSTED_CUSTOM_HOSTS is unset, the gateway trusts localhost, 127.0.0.1, ::1 and host.docker.internal as custom provider hosts, which the record says lets an unauthenticated caller reach loopback and Docker-host services. 1.15.2 (January 12) is the newest release, the last commit to the repository is from May 25, and the maintainers haven't published anything on it. Set TRUSTED_CUSTOM_HOSTS to the hosts you route to, such as a local Ollama server, and don't expose the gateway to callers you don't trust.

ToolHive and GitPython: floors move. ToolHive published seven advisories. An 8.1 (GHSA-f2r8) lets a dynamically registered client obtain codes and tokens for a victim from the embedded authorization server, and a 6.8 covers plaintext Redis connections for the session stores. Both were fixed in 0.52.0, the floor since October 13. Five medium flaws, mostly in the embedded auth server, need 0.54.0, released half an hour before the advisories, which replaces yesterday's 0.53.0 as the floor. GitPython 3.2.1 fixes GHSA-83vg (7.5): code that creates a submodule from an attacker-influenced path ends up with an attacker-controlled hook. On 3.2.0 the validation rejects the path only after the clone, so an app that catches the ValueError thinks it was blocked. The floor moves from 3.2.0, set on October 1. aider-chat 0.86.2 still pins gitpython==3.1.46.

Missed earlier, CVEs assigned yesterday.

• MCP Java SDK CVE-2026-108395 (7.5) and GHSA-5q7x (6.5): the server transports and the SSE client read request and event bodies with no size limit, so one request can exhaust the heap. Fixed in mcp-core 0.18.4, 1.1.4 and 2.0.1 on August 19. This digest didn't cover them then. The older io.modelcontextprotocol.sdk:mcp artifact is affected from 0.8.0 through 0.12.0 with no fix on that line, so move to a maintained mcp-core release. Until then, authentication or an upstream request-size limit stops the request before the read.
• Ludwig CVE-2026-104103 (8.1): dataset archive extraction can write files outside the target directory, fixed in 0.17.8 (July 27). A second advisory from August 16, GHSA-q85h (7.8), covers code execution when resuming from an untrusted checkpoint, fixed in 0.17.9. Take 0.17.9, the newest.

Paperwork your scanner may raise.

• n8n: VulnCheck filed fourteen CVEs overnight (CVE-2026-110840 through CVE-2026-110853) for the September 30 batch, fixed in 2.41.4, 2.42.1 and 1.123.83 and covered on October 1.
• MCP Python SDK: CVE-2026-109527 and CVE-2026-59951 are the request-body and session-reclaim advisories covered on October 1. mcp 1.30.0 or 2.2.0 covers both.
• Angular: CVE-2026-101895 and CVE-2026-101896 are new identifiers for the platform-server and router advisories covered in late September. The Angular DevTools browser extension 1.21.1 fixes a 5.1 that can freeze other tabs (CVE-2026-101897).

For .NET and npm. Microsoft.OpenApi's YAML readers can be pushed out of memory by a small crafted YAML OpenAPI document (CVE-2026-72923, 7.5). The fixes shipped in August: Microsoft.OpenApi.Readers 1.6.30 and YamlReader 2.12.0 / 3.10.0. The record entered GitHub's database last night, so NuGetAudit will start flagging old references. Semantic Kernel's OpenAPI plugin up to 1.80.0 declares Readers 1.6.24, and NuGet restores the lowest version a package declares, so those projects get 1.6.24 unless they reference Readers 1.6.30 or later directly. Plugin 1.80.1 (September 3) and later declare 1.6.31. Metalama 2026.1.19, 2026.0.25 and 2025.1.18 fix a local code-execution flaw through DLL planting in shared temp directories (CVE-2026-62847, 8.2; 6.0 on v4). undici 8.11.0 and 8.11.1 crash the process when the experimental WebSocket client connects to a malicious server over HTTP/2 (CVE-2026-109855, 7.5), fixed in 8.11.2 on September 24. Nodemailer's repository holds thirteen advisories from September, all fixed by 10.0.13 (10.1.1 is current). VulnCheck filed CVEs overnight for three of the four from September 30 (CVE-2026-110869, up to 7.5; 8.7 on v4), and those four are the ones missing from GitHub's database, so npm audit stops at 10.0.9. MSRC's only revision to a tracked product since yesterday is a service-side Azure API Center record covered on October 9. No Angular or PrimeNG advisories today.

Standing items. mcp-remote shipped four releases yesterday afternoon, 0.14.4 through 0.15.1. None of them names the five CVEs from September or the device-code report from October 12, and getServerUrlHash still uses MD5 at 0.15.1. Unchanged since yesterday: Xoscar 0.11.2, Kubeflow Model Registry 0.3.17, vLLM 0.31.0 (PR 51504 merged, in no release), LiteLLM 1.105.1 stable (CVE-2026-93355 open on JWT auth), SGLang 0.5.21, Chroma 1.5.9, BotSharp 5.2.0, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, mistral.rs 0.9.4, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, AstronRPA 1.1.6, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0 and GPT-SoVITS 20250606v2pro. mcp-go released 1.3.0, above its 1.2.1 floor. BrowserSkill PR 363 is unmerged, @deepseek-ai/dsh-client-connection's latest tag still points at the affected 0.0.1-rc.1, and hyper-mcp has only nightly builds after 0.8.3. GitHub's reviewed feed published its first four non-Microsoft records since Friday last night.