Node.js Project to Release Security Updates for 26.x, 24.x, and 22.x Branches

Upcoming Security Releases

The Node.js Project announced that it will release new versions for its 26.x, 24.x, and 22.x release lines. These updates are scheduled for release on or shortly after Wednesday, October 21, 2026. The primary purpose of these releases is to address identified security vulnerabilities within the Node.js framework.

Severity of Issues Addressed

The highest severity issue being fixed across all three active release lines (26.x, 24.x, and 22.x) is classified as HIGH. This indicates that the vulnerabilities could pose significant risks if not patched. Users are advised to apply these updates promptly upon their release to mitigate potential security threats.

Impact on End-of-Life Versions

The announcement also noted that End-of-Life (EOL) versions of Node.js are affected by these security vulnerabilities. While specific updates are not provided for EOL versions, the project recommends that users migrate to an up-to-date, supported version as outlined in their official Release Schedule to ensure ongoing security.

Staying Informed

Users can find the current Node.js security policy on the project's website. For those wishing to report new vulnerabilities, a specific process is detailed in the project's GitHub repository. To receive timely notifications about security vulnerabilities and related releases, users can subscribe to the low-volume nodejs-sec mailing list.