Node.js will ship security fixes on Wednesday, 11 November 2026 for all supported versions: 26.x, 24.x and 22.x. The most serious issue is rated HIGH. Here’s what you need to know and what to do.
What we know
| Node.js version | Highest severity | Fix available |
|---|---|---|
| 26.x (Current) | HIGH | On or shortly after 11 Nov |
| 24.x (LTS) | HIGH | On or shortly after 11 Nov |
| 22.x (LTS) | HIGH | On or shortly after 11 Nov |
| Older (End-of-Life) | Affected | No fix |
This is an early warning. The Node.js team doesn’t publish the details (CVE numbers, what exactly is broken) until the fixed versions are out, so attackers don’t get a head start.
One line from the announcement deserves attention:
„End-of-Life versions are always affected when a security release occurs.”
Node.js Project
If you are still on Node.js 20 or older, you won’t get a fix. Plan your upgrade now.
What to do
- Check your version today: run
node -von servers, in CI and in your Dockerfiles. - Plan time for 11–12 November to update and redeploy.
- Update when the release is out. With nvm, for example:
nvm install 24 --reinstall-packages-from=24. In Docker, rebuild on the newnode:24(or 22 / 26) image. - On an End-of-Life version? Move to 24.x LTS.
To get these warnings first, subscribe to the low-volume nodejs-sec mailing list.
Need help updating Node.js across your projects or getting off an old version? Talk to the Fireup team.
