Node.js schedules security fixes for 22.x 24.x and 26.x lines
Original title: Node.js Schedules High-Severity Security Fixes for 22.x, 24.x, and 26.x Release Lines
Node.js will release high-severity patches for supported 22.x 24.x and 26.x branches on or after November 11 2026 following earlier TLS DNS and Brotli fixes.
The Node.js project announced advance notice of security updates for its three active maintenance branches. Each line will address at least one high-rated vulnerability though specific CVE identifiers and components are not yet detailed. The October Node2Shell Brotli decoder issue was already fixed in 22.23.4 24.22.1 and 26.12.1. Users must migrate from end-of-life versions to supported branches.
Unconfirmed: Exact vulnerability count CVE IDs and components for November patches
- Patches target 22.x 24.x and 26.x lines
- November 11 is target date not guarantee
- Node2Shell fixed in October 2026
- Maintenance branches still receive updates
- End-of-life versions excluded from patch list
Impact: potential process memory corruption or remote code execution
- 1.upgrade to supported release
- 2.monitor release schedule
- 3.test updates before production
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
The Node. js project has scheduled security updates for its 22. x, 24.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.