International
The Morning Dev

Only the news worth knowing

‹
 
C22/100

Incident · high

Node.js releases security updates for version 22, 24 and 26 lines

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Developers running Node.js 22, 24 or 26 release lines

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

  1. Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1 depending on your release line.

The Brief

  • Node.js released security updates for its 22, 24 and 26 release lines on 2026-11-11.
  • Updated versions include Node.js 26.13.1 (LTS), 24.22.3 (LTS) and 22.23.5 (LTS).
  • Details are in the official Node.js vulnerability post for the November 2026 security releases.

Why it matters

Developers running affected Node.js lines should move to the patched point releases, since security fixes are included in these updates.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsNode.js is a server runtime that developers and ops teams build with and run.
NoCore infrastructureNode.js is a widely used runtime, but not in the core infrastructure list like OpenSSH or glibc.
YesPopular toolNode.js is a mainstream developer platform used by many teams.
NoExploited in the wildOpen Source Security post only announces security releases; no source reports observed attacks.
NoPublic exploitSources only announce patched releases and link to an advisory; no exploit code is mentioned.
NoRemote, no loginSources do not describe the attack vector or whether unauthenticated network access is possible.
NoFull takeoverSources do not state that the flaws allow code execution or privilege escalation.
NoSecrets exposedSources report security releases only; no data theft or exposure is mentioned.
NoSupply chainSources describe vulnerability fixes in official releases, not compromised packages or build pipelines.
NoNo fix yetNode.js Blog: 26.13.1, 24.22.3 and 22.23.5 releases are published with the security fixes.

Timeline

  1. Node.js security pre-alert discussed on oss-sec, releases announced as out

  2. Node.js 26.13.1 (LTS) released

  3. Node.js 24.22.3 (LTS) released

  4. Node.js 22.23.5 (LTS) released

  5. Node.js Blog

    Node.js 22.23.5 (LTS)

  6. Node.js Blog

    Node.js 24.22.3 (LTS)

  7. Node.js Blog

    Node.js 26.13.1 (LTS)

  8. Open Source Security

    Re: Node.js security release pre-alert

Full coverage · 4 sources

First seen · 4 sources · Full story page · How tiers are decided