Node.js High-Severity Security Fixes Due October 21

Node.js says it will ship security updates for its 26, 24 and 22 release lines on Wednesday, October 21, 2026, or shortly after, with at least one high-severity flaw fixed in each. It affects websites and apps running on Node.js, including many built with frameworks like Next.js. Unsupported lines won't get a fix.

What we know

  • The notice: the official Node.js page, last updated October 14, 2026, says new releases will be available on October 21 "or shortly after." No time is given.
  • Which lines: 26.x, 24.x and 22.x. In all three, the highest-severity issue being fixed is rated HIGH, per the notice.
  • What we don't know yet: how many flaws there are, their CVE IDs, which parts of Node.js they affect and which version numbers fix them. The notice doesn't say.
  • Unsupported lines: the notice reminds users that end-of-life versions are always affected when a security release happens. Per the official Node.js schedule, the 20 line reached end of life on April 30, 2026, and 18 on April 30, 2025; the odd-numbered 23 and 25 lines are also unsupported. They won't get these fixes.
  • Where each line stands: 22 is in maintenance until April 30, 2027; 24 moves from Active LTS to maintenance on October 20, 2026; 26 is the Current line and becomes LTS on October 28, 2026.
  • Today's versions: the page lists 24.22.0 as the latest LTS and 26.12.0 as the latest release. It doesn't say they include these fixes.

What changes and what doesn't

What changes is the calendar: there's a fixed date to update and almost a week to get ready. There's nothing to install yet, and the notice doesn't say these flaws are being exploited.

It doesn't affect PHP-only sites, like most WordPress or Drupal installs, unless their server runs Node.js for another job. The priority is anything running on an internet-facing server; tools that only run on a developer's laptop should be updated too, with less urgency.

How to tell if it affects you

  1. Check your version. On the server or in the project folder, run `node -v`. If it starts with v22, v24 or v26, you'll get a patch on the 21st. If it starts with v20, v18 or an odd number, you won't: you need to move to a supported line.
  2. If you're on an unsupported line, use these days to move to 22 or 24 and test your site in staging before switching production. That way, on the 21st you only need to apply the patch.
  3. On hosting with a control panel, some providers offer a Node.js apps section where you pick the version. If you can't find it, ask your host which version your site runs and whether they'll patch on the 21st.
  4. On platforms like Vercel or Netlify, the Node.js version is set in your project settings. Check which one you have and make sure it's not an unsupported line.
  5. On October 21, check the Node.js security blog, install the fixed release for your line, and restart the app: the old process keeps running until it restarts.
  6. If someone else maintains your site, ask them today which Node.js version it runs and when they'll apply the patch.

Related: Next.js Critical Flaws: Update to 16.4.1 or 15.5.28

Sources

Updates: when Node.js publishes the fixed releases and the flaw details, we'll add them here with a link.