# Umami 3.4.1 urges self-hosters to patch Next.js RCE and MCP OAuth leakage

The open-source analytics platform's October 23 security hotfix upgrades Next.js, MCP libraries, React and its Node Docker base. Umami says all self-hosted users should upgrade; the release requires no database migration.

Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.

- Status: Active
- Published: 2026-10-26T08:36:12+13:00
- Updated: 2026-10-26T08:36:12+13:00
- Categories: Web Development, Marketing & Distribution, Developer Tools, Conversion & Analytics
- Tags: analytics, Next.js, Node.js, OAuth, security updates, self-hosting, Umami
- Canonical HTML: https://beyondthe.news/dossiers/umami-3-4-1-security-hotfix-nextjs-rce-mcp-oauth-node-docker

## What changed

Umami released v3.4.1 on October 23, 2026 as a security-focused update for self-hosted analytics. It upgrades Next.js from 16.3.4 to 16.4.2 to address a critical remote-code-execution vulnerability in next/og, server-side request forgery in image optimisation, cache poisoning and an information-disclosure issue. React and React DOM move to 19.3.1, and the Docker base is pinned to Node 22.23.4-alpine with October Node.js security fixes. MCP server and client packages move to 2.3.1, addressing an OAuth credential-leak advisory. Vulnerable transitive dependencies including vite, undici and sharp also receive higher security floors. The maintainer explicitly recommends that all self-hosted users upgrade, rebuild or re-pull images; the release lists no migrations.

## Why it matters

Self-hosted analytics is often installed once and then left alone, but its web dashboard and integrations inherit vulnerabilities from the framework, runtime and protocol dependencies it bundles. Even operators who have read general Next.js or Node advisories need an Umami-specific version and image to receive the fixes. The practical decision is to update the running application and verify that the deployed image actually contains patched dependencies; simply updating a host Node installation does not necessarily replace a vulnerable container image.

## The web framework and runtime both change

Umami v3.4.1 moves Next.js to 16.4.2 from 16.3.4, covering the upstream next/og RCE and image-optimisation SSRF among other advisories. React and React DOM are updated to 19.3.1. The Docker base moves to Node 22.23.4-alpine; administrators using Docker must pull or rebuild images so that the runtime changes take effect.

## MCP OAuth and transitive dependency fixes

The release updates @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/client to ^2.3.1, referencing GHSA-6qxp-vccf-f47h for an OAuth credential leak. It also raises dependency security floors for vite, undici, sharp, shell-quote, brace-expansion, fast-uri, postcss-selector-parser and source-map-js. Not every deployment necessarily exposes every vulnerable code path; the vendor's blanket update recommendation is a safer operational rule than inferring immunity from feature usage.

## What operators should do

Identify your installed Umami version and image digest, deploy v3.4.1 or newer using your existing tested process, re-pull or rebuild Docker images, and confirm startup, authentication and event ingestion. The release lists no database migration. Back up application configuration and database before upgrading, and assess credential rotation if an exposed integration may have handled OAuth tokens. The release notes do not assert that all installations were exploited.

## Key details

- Umami v3.4.1 released October 23, 2026; primarily a security hotfix.
- Next.js 16.3.4 → 16.4.2 includes critical next/og RCE and SSRF remediation.
- MCP server/client upgraded to 2.3.1 for OAuth credential leak advisory GHSA-6qxp-vccf-f47h.
- Node Docker base pinned to 22.23.4-alpine; fresh images required.
- No migrations listed; all self-hosted users are urged to upgrade.

## Builder takeaways

- Update Umami to v3.4.1 or newer rather than assuming upstream Next.js patches propagate automatically.
- Rebuild or pull the Docker image and verify the running digest and version.
- Back up first, smoke-test dashboards and event ingestion, and review OAuth credential exposure if MCP integrations are used.

## What to watch

- Any follow-up Umami release addressing additional upstream security advisories.
- Independent validation of exposure paths and any evidence of active exploitation.
- Compatibility reports from self-hosted Docker and source-build users.

## Uncertainties

- The release notes do not establish which Umami configurations expose each upstream vulnerable code path.
- No Umami-specific exploitation incident is confirmed in the release announcement.
- Impact and credential rotation decisions depend on actual integration configuration and logs.

## Sources

- [Umami v3.4.1 release notes](https://github.com/umami-software/umami/releases/tag/v3.4.1) — Umami maintainers · primary_release · 2026-10-23T00:00:00+13:00. Signed security hotfix notes, dependencies, deployment guidance and no-migration declaration.
- [Umami dependency remediation PR 4645](https://github.com/umami-software/umami/pull/4645) — Umami contributors · primary_implementation · 2026-10-23T00:00:00+13:00. Dependency updates for Next.js and MCP security fixes.
- [Umami dependency remediation PR 4661](https://github.com/umami-software/umami/pull/4661) — Umami contributors · primary_implementation · 2026-10-23T00:00:00+13:00. Additional MCP and transitive dependency updates.
- [MCP OAuth credential leak advisory](https://github.com/advisories/GHSA-6qxp-vccf-f47h) — GitHub Advisory Database · independent_advisory · 2026-10-23T00:00:00+13:00. Referenced upstream OAuth credential-leak issue; scope depends on integration.