What changed
Umami released v3.4.1 on October 23, 2026 as a security-focused update for self-hosted analytics. It upgrades Next.js from 16.3.4 to 16.4.2 to address a critical remote-code-execution vulnerability in next/og, server-side request forgery in image optimisation, cache poisoning and an information-disclosure issue. React and React DOM move to 19.3.1, and the Docker base is pinned to Node 22.23.4-alpine with October Node.js security fixes. MCP server and client packages move to 2.3.1, addressing an OAuth credential-leak advisory. Vulnerable transitive dependencies including vite, undici and sharp also receive higher security floors. The maintainer explicitly recommends that all self-hosted users upgrade, rebuild or re-pull images; the release lists no migrations.
Why it matters
Self-hosted analytics is often installed once and then left alone, but its web dashboard and integrations inherit vulnerabilities from the framework, runtime and protocol dependencies it bundles. Even operators who have read general Next.js or Node advisories need an Umami-specific version and image to receive the fixes. The practical decision is to update the running application and verify that the deployed image actually contains patched dependencies; simply updating a host Node installation does not necessarily replace a vulnerable container image.
The web framework and runtime both change
Umami v3.4.1 moves Next.js to 16.4.2 from 16.3.4, covering the upstream next/og RCE and image-optimisation SSRF among other advisories. React and React DOM are updated to 19.3.1. The Docker base moves to Node 22.23.4-alpine; administrators using Docker must pull or rebuild images so that the runtime changes take effect.
MCP OAuth and transitive dependency fixes
The release updates @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/client to ^2.3.1, referencing GHSA-6qxp-vccf-f47h for an OAuth credential leak. It also raises dependency security floors for vite, undici, sharp, shell-quote, brace-expansion, fast-uri, postcss-selector-parser and source-map-js. Not every deployment necessarily exposes every vulnerable code path; the vendor's blanket update recommendation is a safer operational rule than inferring immunity from feature usage.
What operators should do
Identify your installed Umami version and image digest, deploy v3.4.1 or newer using your existing tested process, re-pull or rebuild Docker images, and confirm startup, authentication and event ingestion. The release lists no database migration. Back up application configuration and database before upgrading, and assess credential rotation if an exposed integration may have handled OAuth tokens. The release notes do not assert that all installations were exploited.