Skip to content
Emir Hoca.

Node.js security release on 11 November: getting ready on 22, 24 and 26

Node.js ships a high-severity security release for the 22, 24 and 26 lines today, the second round after October's Brotli fix.

2 min read

The Node.js project announced new security releases for the 26.x, 24.x and 22.x lines on or shortly after 11 November 2026. The most serious issue being fixed is rated high (Node.js, 3 November 2026). When I wrote this, the announcement had no CVE list or new version numbers yet. I won't guess them, but you can get ready now.

Why it matters

Most sites built with Next.js, Nuxt or Express run on Node.js, and so do their build steps. This is the second coordinated security release in three weeks. The 21 October release fixed ten CVEs in 26.12.1, 24.22.1 and 22.23.4. One of them was a memory bug in the Brotli decoder: decompressing malformed Brotli data with node:zlib could crash the app, leak memory or allow remote code execution (Node.js, 21 October 2026).

The Node.js team repeats the same warning with every security release: end-of-life versions are always affected and get no fix. If you are on Node 20 or older, this release won't reach you.

What to do today

  1. Check the Node version on every server and in every Dockerfile (node -v, the FROM node:... line).
  2. If anything runs 20 or older, plan the move to 22, 24 or 26.
  3. At the very least, make sure you are on the October patches (22.23.4, 24.22.1, 26.12.1).
  4. When the new release is out, read the advisory, rebuild your Docker image and deploy it. Rebuilding the image in CI, rather than patching the server by hand, makes it easier to know what is actually running.

For this site I build images in GitHub Actions on a node:22-alpine base, so rebuilding the image after the release is enough to get the fix. If you'd like to check your Node.js version together, reach out.

Sources