JavaScript — 2026 Week 31

Nuxt recommends an immediate upgrade to 4.5.1 or 3.21.10 and a deduped lockfile that includes @nuxt/devtools@3.3.1. The release fixes conditional server-side code execution through island props, unauthorized component instantiation, uppercase route-rule authorization bypass, and two server-component denial-of-service paths. Nuxt 4.x also patched cross-user disclosure of authenticated _payload.json responses cached under cache, swr, or isr; upgrading does not evict a bad response already stored upstream. A separate critical DevTools RPC flaw affects development environments reachable from the host, LAN, or a malicious site, but not production deployments.

Express released body-parser 1.20.6 and 2.3.0 for CVE-2026-12590, a Low-severity denial-of-service flaw. In older versions, an unparsable string or NaN passed as the limit option made bytes.parse() return null, silently skipping request-size enforcement. Applications that computed the value dynamically or accepted configuration from another system could then ingest arbitrarily large bodies and exhaust memory or CPU. Patched versions throw during parser construction instead of accepting an unsafe configuration. Teams should upgrade and add a startup test for the configured body limit, especially where that limit is the primary oversized-request defense.

WebMCP proposes that a page expose schema-typed, route-scoped tools rather than force agents to interpret screenshots, accessibility trees, or raw DOM. It is not the MCP wire protocol: there is no JSON-RPC transport, and the design is explicitly human-in-the-loop rather than unattended automation. Imperative tools register through document.modelContext; declarative forms can derive schemas from controls and require a human click unless toolautosubmit is present. Cross-origin registration is disabled by default and must be delegated through Permissions Policy. The proposal is still an experimental W3C Community Group draft in a Chrome origin trial, so teams should prototype and give feedback without making production commitments.

Auth0's Next.js SDK v4 aligns authentication with the App Router's server-first execution model. A shared Auth0Client and proxy.ts replace legacy auth route handlers, while getSession() reads encrypted cookies directly inside Server Components and Server Actions. The important boundary is that every Server Action must authenticate again: it executes independently, and a session may have changed since the page rendered. Layout guards work well for private route groups, but proxy matchers must be reviewed as security policy so sensitive paths are not accidentally excluded. Client-side useUser() remains useful for presentation only, never authorization or protected mutations.