The Node.js project said on 14 October that it will publish security updates for three release lines. The lines are 26.x, 24.x and 22.x. The updates are due on or shortly after Wednesday, 21 October 2026. Node.js rates the most serious flaw fixed in each of the three lines as HIGH.
The notice does not say how many flaws the updates fix. It does not name them, give their CVE numbers, or say which parts of Node.js they touch. There is no exact release time, only "on or shortly after" the date. The project did say that end-of-life versions, which it no longer supports, are always affected when a security release comes out.
Teams that run Node.js 22, 24 or 26 can plan to update once the new versions appear. Node.js tells anyone on an end-of-life version to move to a current one. It also points people to its low-volume nodejs-sec mailing list for security announcements.