Node.js Releases Security Updates for 26.x, 24.x, and 22.x

What happened

The Node.js project announced that it will release security updates on or shortly after Wednesday, October 21, 2026. The updates target three active release lines: 26.x, 24.x, and 22.x. These releases are being issued to address security vulnerabilities discovered in the runtime.

What changed

Each of the three release lines—26.x, 24.x, and 22.x—contains at least one HIGH-severity security issue that is being fixed in the upcoming releases. The highest severity issue fixed across all three release lines is rated HIGH. The source does not disclose the specific nature of the vulnerabilities or provide detailed technical information about what each fix addresses, as is typical for security announcements released ahead of patch availability.

Who it affects

Any developer or organization running Node.js 26.x, 24.x, or 22.x should plan to update. The project notes that End-of-Life versions are also affected by the same vulnerabilities, though only the active release lines listed will receive patched versions. Developers using versions outside the three active lines should consult the Node.js Release Schedule to determine their support status and upgrade path.

What to do

Update to the latest version in your active release line as soon as patches are available on or after October 21, 2026. Check the Node.js Release Schedule to confirm which version line you are running and its support status. For versions that have reached End-of-Life, consider upgrading to a currently supported release line.

The Node.js project operates a low-volume announcement-only mailing list at nodejs-sec where you can subscribe to receive immediate notification of security releases and vulnerabilities. This allows you to stay informed without subscribing to general project communications. The full security policy is available at https://nodejs.org/en/security/, and vulnerability reporting instructions are documented in the Node.js repository.

Commercial support for versions beyond the Maintenance LTS phase is available through OpenJS Ecosystem Sustainability Program partners, which may be relevant for organizations managing extended deployments of older release lines.

Why it matters

HIGH-severity vulnerabilities in Node.js can affect any application built on the runtime, from production web servers to command-line tools. Prompt patching is essential to minimize the risk of exploitation. The coordination of updates across three active release lines reflects the breadth of deployed Node.js instances and the importance of maintaining security across the ecosystem. Developers should treat the October 21 release date as a critical maintenance window.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.