# Node.js to release security fixes for versions 26, 24 and 22 on 11 November

On 3 November 2026 the Node.js project said it will publish security updates for its three supported release lines on or shortly after Wednesday 11 November. The most serious issue being fixed is rated high severity.

- Page: https://www.cognivise.co.uk/news/node-js-security-releases-due-11-november-2026
- Topic: Running software
- Published: 2026-11-06
- Updated: 2026-11-06
- Author: Cognivise
- Source: nodejs.org, Wednesday, November 11, 2026 Security Releases (https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)

## Key takeaways

- The Node.js project will release security fixes for its 26.x, 24.x and 22.x lines on or shortly after 11 November 2026, with the most serious issue rated high.
- Node.js versions past end of life are affected too but will not receive the fixes, so they need upgrading.
- Before 11 November, find out whether your software runs on Node.js, which version, and who will apply the update.

## What the Node.js project announced

Node.js is the software that runs many websites, online stores, APIs and back-end systems. On 3 November 2026 the [Node.js project](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases) gave advance notice of new versions for its 26.x, 24.x and 22.x release lines. The project expects to publish them on Wednesday 11 November 2026, or a little later.

The project rates the most serious issue in each of the three lines as high. It has not yet said how many issues are being fixed or what they are. As is usual for these notices, the details are held back until the fixes are out.

The notice also repeats a standing point: versions that have reached end of life are always affected when a security release happens, and they do not receive the fixes.

## Which Node.js applications are affected

If your website, store, API or internal tool runs on Node.js 26, 24 or 22, it will need updating once the new versions are published. A high rating means the flaws are serious enough that leaving them unpatched carries real risk to your systems and customer data.

If your software runs on an older Node.js version that is past end of life, you are in a worse position. It will be exposed to the same problems with no free fix. The project points to commercial support for such versions through partners in its OpenJS Ecosystem Sustainability Program, but the lasting answer is an upgrade.

Software that does not use Node.js at all is not affected by this release. Many owners do not know whether theirs does, which is the first thing to find out.

## What to do before 11 November

There is nothing to install yet, but you can prepare so the update goes out quickly:

- Ask your developer or supplier whether your software uses Node.js, and which version.
- If it is on 26, 24 or 22, book time to apply, test and deploy the update soon after 11 November.
- If it is on an end-of-life version, ask for an upgrade plan and a rough cost now.
- Check whether your [software maintenance contract](https://www.cognivise.co.uk/blog/software-maintenance-contract-guide) covers security updates like this one, or whether each one is billed separately.
- Watch for the full details when the releases are published, or have your developer subscribe to the project’s nodejs-sec mailing list.

If no one currently looks after your software in this way, Cognivise offers [ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership) that includes applying security updates.

## Related

- [Ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership)
- [Software maintenance contracts: what a fair one includes](https://www.cognivise.co.uk/blog/software-maintenance-contract-guide)
- [What should software support cover after launch?](https://www.cognivise.co.uk/blog/what-application-support-covers)