Node.js advisory covers node before 24.22.3, 26.13.1 and 22.23.5
Original title: Nodejs security advisory (AV26-1156)
Canada’s Cyber Centre issued AV26-1156 on November 12 and told administrators to apply updates as they become available.
The Canadian Centre for Cyber Security published advisory AV26-1156 on November 12, 2026. It says the Node.js product node was affected as of November 11 in builds prior to v24.22.3, v26.13.1 and v22.23.5. The notice does not name a CVE or describe the flaw, and it points readers to Node.js security releases and any necessary updates.
Unconfirmed: The advisory does not describe the vulnerability, its severity, or whether it is being exploited.
- The advisory serial number is AV26-1156, dated November 12, 2026.
- Affected ranges are prior to v24.22.3, v26.13.1 and v22.23.5.
- The text does not state impact, exploitation or a CVE identifier.
| Product | Affected |
|---|---|
| Node.js node | prior to v24.22.3; prior to v26.13.1; prior to v22.23.5 |
- 1.Review the linked Node.js security releases and apply necessary updates.
- Vendors
- Node.js
- Products
- node
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1156 Date: November 12, 2026 As of November 11, 2026, Nodejs is affected by a vulnerability in the following product: node Prior to v24. 22. 3 Prior to v26.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.