Node.js to release security patches on November 11 for lines 26.x, 24.x and 22.x

Node.js has announced upcoming security releases for lines 26.x, 24.x and 22.x, due on or shortly after Wednesday, November 11, 2026. The highest severity issue in this round is HIGH. This article tells you whether the version you run is affected, and what to do before then.

What’s coming on November 11

According to the official Node.js pre-announcement, new versions of lines 26.x, 24.x and 22.x will arrive on or shortly after Wednesday, November 11, 2026, to fix security vulnerabilities. The highest severity issue fixed in this release is HIGH, in all three lines.

Why there are no CVE IDs or patch version numbers yet

Node.js only publishes CVE IDs, technical details and patch version numbers together with the official release. As of this writing, none of the three is available to look up — and this article won’t guess them either.

Who is affected

If you run one of the three lines — 26.x, 24.x or 22.x — you will get a patch in this round.

Versions that have reached end of life are also always affected whenever a security release happens, according to Node.js itself. Node.js recommends running the latest version following its release schedule.

Is November 11 a firm date?

November 11 is a target date, not a commitment. The announcement says the releases will arrive “on, or shortly after” Wednesday, November 11, 2026, so they may land a little later.

What to do right now

Open a terminal on your machine and run this command to see which Node.js version you have:

node -v

This prints the Node.js version running on your machine. The first number after the v tells you which line you are on. If it is 26, 24 or 22, you are covered by the patch: wait for the official release, then update. If it is an older, unsupported line, upgrade to one of the three lines above instead of waiting for a patch. You don’t need to do anything about CVE IDs — there are none to look up yet.

Don’t confuse this with the October 21 round

The October 21, 2026 round was a different one, and its patches are already out: 22.23.4, 24.22.1 and 26.12.1. That round fixed 10 vulnerabilities, including CVE-2026-111497 (Node2Shell, a flaw in the Brotli library). It scored 9.2 on the CVSS 4.0 scale (9.8 on the 3.1 scale). CVSS is a scoring system for how severe a vulnerability is, running from 0 to 10 — the higher the score, the more dangerous the flaw. It is also being actively exploited, and has been on the CISA KEV list since October 27. CISA KEV is a list of vulnerabilities confirmed to be actively exploited, published by CISA, the US cybersecurity agency.

The November 11 round is a new one, and there is no evidence linking it to Brotli or to CVE-2026-111497.

If you haven’t updated since the October 21 round, update to that round’s patches first — don’t wait until November 11.

I will update this article as soon as Node.js publishes the official patch version numbers and CVE IDs on November 11.

Sources

The sources below were verified on November 5, 2026.

• Node.js — Wednesday, November 11, 2026 Security Releases
• Node.js — Wednesday, October 21, 2026 Security Releases