Node.js Schedules High-Severity Security Fixes for 22.x, 24.x, and 26.x Release Lines

The Node.js project has scheduled security updates for its 22.x, 24.x, and 26.x release lines on or shortly after Wednesday, November 11, 2026. The announcement gives developers and system administrators time to prepare for patches addressing HIGH-rated vulnerabilities across all three branches.

Each release line will receive a fix for at least one high-severity issue. However, the advance notice does not list vulnerability counts, CVE identifiers, affected components, or fixed version numbers. It also provides no details about attack methods or confirmed exploitation, leaving the exact technical risk unclear until further information becomes available.

The planned updates follow earlier Node.js security fixes covering TLS, DNS, and Brotli. Those October patches addressed separate weaknesses in certificate checks, name resolution, and compressed data handling.

Node2Shell Adds Concern

One notable October issue was Node2Shell, tracked as CVE-2026-111497, a high-severity flaw in Node.js’s bundled Brotli decoder. It affected the same three release lines and could allow an attacker to corrupt process memory when an application decompressed malicious Brotli data through the node:zlib module.

The decoder incorrectly treated an invalid block switch as a request for more input rather than a permanent error. It then continued adding bytes beyond an eight-byte internal buffer. Depending on application behavior, this could cause a crash, expose process memory, or allow remote code execution.

According to the official October advisory, Node2Shell was addressed in that earlier security release. Fixes shipped in versions 22.23.4, 24.22.1, and 26.12.1. It should therefore be treated as separate background, not described as a confirmed vulnerability in November’s planned patch set.

Supported Versions and Older Releases

Node.js also warns that end-of-life versions are affected when security releases occur. Running an older branch should therefore not be treated as protection simply because it is absent from the patch list. The project directs users toward an up-to-date, supported release rather than continued use of unsupported versions.

The official release schedule lists Node.js 26.x as Active Long-Term Support, while 24.x and 22.x are in Maintenance support. Maintenance branches still receive security updates. Earlier coverage of Node.js security flaws affecting supported branches shows why teams must track runtime updates alongside application changes.

According to the official security advisory, November 11 is a target rather than a guaranteed publication deadline. Teams should monitor the notice for release availability and technical details. Until those details arrive, claims about remote code execution, data theft, or specific workarounds would go beyond the published information.

For deployment planning, the Node.js release schedule provides the support status and end-of-life dates for each branch. The immediate priority is identifying which release lines applications use and preparing to test the forthcoming updates.

Organizations on unsupported versions should plan migration to a supported branch rather than expect patches for retired releases.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.