Vulnerability
Published 2026-11-03 New
Verified 2026-11-06
Node.js advance notice: security releases for the 26.x, 24.x and 22.x lines due on or shortly after 11 November 2026; highest severity High in all three lines
The Node.js project said in an advance notice (page last updated 3 November 2026) that it will release new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 11 November 2026 to fix security issues.
It says the highest severity issue fixed in each of the three lines is rated High. The notice does not list CVE numbers, affected components or fixed version numbers; those come with the release.
Node.js notes that end-of-life versions are always affected when a security release occurs and tells users to stay on an up-to-date version as set out in its release schedule. (source: Node.js security release notice)
- Product
- Node.js JavaScript runtime (26.x, 24.x and 22.x lines)
- Versions
- 26.x, 24.x and 22.x lines; end-of-life lines are always affected (Node.js). Fixed versions not yet published.
- CVSS
- not published; Node.js rates the highest-severity issue High in each line
- Patch to
- Plan to update Node.js (including Docker base images, serverless runtimes and CI runners) when the releases ship on or after 11 November 2026; move anything on an end-of-life line to a supported one.