Node.js to Ship Security Updates for Three Lines
The Node.js project plans high-severity security fixes across its 22.x, 24.x, and 26.x release lines on or after November 11, 2026.
Updated on Nov. 4, 2026 in Cybersecurity
The Node.js project has scheduled security updates for its 22.x, 24.x, and 26.x release lines, with each line set to receive a fix for at least one HIGH-rated vulnerability. The advance notice does not list vulnerability counts, CVE identifiers, affected components, or fixed version numbers.
Why it matters
Node.js is widely used to run web applications and server-side software, so high-severity fixes across all active branches affect developers and operators who depend on it. Earlier October patches addressed weaknesses in TLS, DNS, and Brotli, and the coming updates arrive as organizations are still applying those fixes.
The earlier Node2Shell flaw, tracked as CVE-2026-111497, was a high-severity bug in Node.js's bundled Brotli decoder that continued writing past an eight-byte internal buffer and was fixed in versions 22.23.4, 24.22.1, and 26.12.1. Whether the coming November fixes address similar components or introduce new fixed versions has not been disclosed.
The players
Node.js Project
The open-source JavaScript runtime project maintained by a global community of contributors and governed by the OpenJS Foundation, responsible for releasing its security updates.
The details
Node.js's earlier October security releases addressed a high-severity Brotli decoder flaw in which an invalid block switch was treated as a request for more input instead of a permanent error, allowing the decoder to keep adding bytes beyond its eight-byte buffer. Depending on how an application uses the library, the flaw could cause a crash, expose process memory, or allow remote code execution.
Timeline
October 2026: Node.js releases security fixes for TLS, DNS, and Brotli weaknesses.
November 11, 2026: Target date for the scheduled security updates across the 22.x, 24.x, and 26.x lines.
Roadmap
The scheduled updates follow Node.js's support model, in which 26.x is Active Long-Term Support while 24.x and 22.x remain in Maintenance. Patching all three supported lines together mirrors the project's approach of keeping older branches secure until their support ends.
Developers and operators running applications on Node.js 22.x, 24.x, or 26.x should plan to apply the coming updates once released. Teams that have not yet installed the October fixes, including the 22.23.4, 24.22.1, and 26.12.1 versions, should prioritize them now.
The takeaway
Keeping every supported Node.js release line current is the most direct way to stay protected from high-severity flaws in bundled libraries like Brotli. Checking your installed version against the latest patched release now will make the November updates easier to apply.
What happens next
The Node.js project is scheduled to publish security updates for its 22.x, 24.x, and 26.x release lines on or shortly after November 11, 2026.
Further reading
Follow broader developments in software vulnerabilities and patching in our Cybersecurity section.
