Node.js security releases
The Node.js project announces security releases in advance and fixes all supported release lines at the same time. This page tracks our coverage of Node.js security releases and advisories, newest first, so teams can see what changed and what to upgrade.
Latest
Node.js 26.12.1 fixes nine security issues, five rated High The patches reach into encryption, name lookups and compression, code few teams look at directlyEarlier reporting
Node.js patches Brotli flaw that can allow remote code execution Ten security fixes landed for Node.js 22, 24 and 26, and Vercel urges teams to upgrade. Node.js plans security releases for 26.x, 24.x and 22.x on October 21 The project says the most serious flaw fixed in each line is rated HIGH. Node.js 26.11.1 released with three reverts to documentation tooling The Current release, dated 7 October 2026, lists only three changes, all undoing earlier documentation work. Node.js 26.11.0 ships updated OpenSSL, root certificates and HTTP client A runtime release is also a bundle of other people's code. Here is what this one changes and what to ask. Crafted URLs can crash Angular server rendering on Node.js, advisory says Paths chaining 90–740 numeric segments, sent in bursts, can exhaust memory. Proxy rules can limit exposure. Node.js TLS Hostname Bypass: NVD Says CVSS 9.8. HackerOne Says 5.6. Every Framework Built on Node Is Caught in the Middle. CVE-2026-48930: embedded nul-bytes in hostnames cause silent authority rebinding via C-string truncation. Node.js 22, 24, and 26 affected. The severity dispute exposes a scoring system failure. Node.js June 17 Security Release Affects Every Modern JavaScript Framework Critical patches across Node.js LTS lines. Next.js, Nuxt, Remix, Astro, SvelteKit — every Node-based framework inherits the vulnerability window.Other trackers: PHP2Shell, Windows updates, eMudhra certificate compromise, DeepSeek