⏰ Node.js, 11/11/26: a HIGH-severity security release is coming for every supported line, three weeks after the last one
Source: Node.js — Wednesday, November 11, 2026 Security Releases (nodejs.org, posted 2026-11-03)
The Node.js project pre-announced on November 3 that new versions of the 26.x, 24.x and 22.x lines will ship on or shortly after Wednesday, November 11, with the highest severity rated HIGH on all three. That's all the pre-announcement says — no CVEs, no component names. The details land with the releases; that's how Node does it.
What makes this one worth a post before the details exist is the calendar. The last security release was October 21, and it was a big one: ten CVEs, including a remote-code-execution bug in the bundled Brotli decoder that had public exploit traffic within a week. Node's normal gap between security releases this year has been two to three months. Three weeks is short. That might mean a follow-on to the October work, or something unrelated. Either way: if you run Node — on a server, in build tooling, or as node.exe on a Windows box — plan to pull the 11/11 release the day it lands, and check which line you're on now (node -v). Node 20 reached end of life on April 30 and won't get this fix.
The 2026 cadence, for context
| Date | Lines | Worst | What it was |
|---|---|---|---|
| Jan 13 | 20, 22, 24, 25 | High | Permission Model bypass via crafted symlinks; HTTP/2 malformed-HEADERS crash; async_hooks uncatchable stack overflow |
| Mar 24 | 20, 22, 24, 25 | High | __proto__ as an HTTP header name crashes any server; HTTP/2 WINDOW_UPDATE leak; HashDoS in V8; another Permission Model bypass (Unix sockets) |
| Jun 18 | 22, 24, 26 | High | TLS hostname-matching inconsistencies (mTLS trust-policy bypass); HTTP agent accepting a response sent before the request |
| Jul 29 | 22, 24, 26 | High | (postponed twice from 7/27 for testing and infrastructure) |
| Oct 21 | 22, 24, 26 | High | Brotli decoder out-of-bounds write → RCE (CVE-2026-111497); two TLS hostname bypasses (fullwidth digits; loose IP resolution); DNS NUL truncation; Permission Model bypass via fs.realpathSync; entropy caches frozen into snapshots/SEAs; plus bundled OpenSSL, undici, c-ares, SQLite, CA-store updates |
| Nov 11 | 22, 24, 26 | High | not yet published |
Sources for the table: the Node.js vulnerability posts for January, March, June, July and October. Two patterns in it: TLS hostname checking has needed fixing three times, and the Permission Model has been bypassed four times, every time by indirection (a symlink, a socket, a realpath, a wildcard).
The October one, because it's the context for November
- Node.js — October 21, 2026 Security Releases — the primary. Patched versions: v26.12.1, v24.22.1, v22.23.4.
- oss-security: Re: Upcoming Node.js security release 2026/10/21 — Jan Schaumann pointing out the Brotli bug isn't a Node bug; it's a Google Brotli bug that reaches every consumer (Envoy, Ubuntu's packages, Python libraries). "I don't use Node.js" is not a reason to ignore it.
- Help Net Security — Brotli bug reaches far beyond Node.js — the fixed Brotli library versions only shipped the week after the Node fix, and a threat-intel firm reported exploit traffic in the wild by the 27th carrying a public exploit that gets a shell on vulnerable builds. Six days from disclosure to in-the-wild.
- Cybersecurity News — Node.js Releases Security Updates — a readable summary of the ten; notes the TLS fixes follow earlier hostname-handling patches.
- Vendure — What the October 2026 Node.js security releases mean for your store — a vendor's plain-language version for people who run Node without thinking of themselves as Node people. Useful for the "check which line you're on" habit and the pinned-Docker-tag gotcha.
Drafted with Claude Fable 5.1 · 2026-11-04 · sources fetched 2026-11-04 (America/Chicago)