Node.js High-Severity Security Fixes Due November 11

Node.js says it will ship security updates for its 26, 24 and 22 release lines on Wednesday, November 11, 2026, or shortly after, with at least one high-severity flaw fixed in each. It affects websites and apps running on Node.js. End-of-life lines, such as 20, won't get the fix.

What we know

The notice: the official Node.js page, published November 3, 2026, says new releases for the 26.x, 24.x and 22.x lines will be available on November 11 "or shortly after." No time is given.
Severity: in all three lines, the highest-severity issue being fixed is rated HIGH, per the notice. The same pre-alert went to the public oss-security mailing list on November 4.
What we don't know yet: how many flaws there are, their CVE IDs, which parts of Node.js they affect and which version numbers fix them. The notice doesn't say.
Second batch in three weeks: on October 21, Node.js shipped 26.12.1, 24.22.1 and 22.23.4, fixing 10 flaws (4 high, 3 medium and 3 low severity), according to its October security page.
Unsupported lines: the notice reminds users that end-of-life versions are always affected when a security release happens. Per the official Node.js schedule, the 20 line reached end of life on April 30, 2026, and 25 on June 1, 2026. They won't get these fixes.
How long each line lasts: 22 is supported until April 30, 2027; 24 until April 30, 2028; 26 until April 30, 2029. The schedule itself notes that dates may change.

What changes and what doesn't

What changes is the calendar: there's a fixed date to update and three days to get ready. There's nothing to install yet, and the notice doesn't say these flaws are being exploited.

Sites built only with PHP, like most WordPress or Drupal sites, aren't affected unless their server runs Node.js for some other job. What's urgent is anything running on an internet-facing server; tools that only run on a developer's machine are worth updating too, with less hurry.

How to tell if you're affected

Check your version. On the server or in the project folder, run `node -v`. If it starts with v22, v24 or v26, you'll get a patch on the 11th. If it starts with v20, v18 or an odd number, you won't: you need to move to a supported line.
Check whether you skipped October's patch. If you're below 26.12.1, 24.22.1 or 22.23.4, you're one patch behind. Catch up within your line this week: Wednesday's jump will be smaller and you'll know the site works on the October release.
If you're on an unsupported line, use these days to move to 24 or 26 and test the site in a staging environment before switching production.
On hosting with a control panel, some providers have a Node.js apps section where you pick the version. If you don't see one, ask your provider which version your site uses and when they'll apply the patch.
On cloud platforms, the Node.js line is set in the project configuration. Check which one you have and make sure it isn't unsupported.
If the site runs in a container, the base image sets the version. After the patch, rebuild the image and redeploy; restarting the old container isn't enough.
On November 11, check the Node.js security blog, install the fixed release for your line and restart the app: the old process keeps running until it restarts.
If someone else maintains the site, ask them today which Node.js version it runs, whether they applied October's patch and when they'll apply the November one.

Sources

Updates: when Node.js publishes the fixed releases and the flaw details, they'll be added here with a link.