Node.js has released significant security updates for its supported LTS versions, including v26.13.1, v24.22.3, and v22.23.5, addressing 16 CVEs primarily affecting the HTTP/2 and TLS layers, with several vulnerabilities rated as HIGH and remotely exploitable. The updates patch vulnerabilities missed by the end-of-life version Node 20, which has not received any security fixes despite being used by some organizations. This release highlights ongoing issues with Node.js's networking stack, particularly concerning memory safety, and marks a transition to a new release schedule that will see one major version annually starting in October 2026. Users are advised to upgrade to the latest LTS versions and take immediate steps to secure their systems if unable to do so

Node.js 26, 24, and 22 Get Major TLS and HTTP 2 Security Fixes

Node.js rolled out coordinated security updates, patching 16 CVEs across its three supported LTS lines: v26.13.1 "Lithium", v24.22.3 "Krypton", and v22.23.5 "Jod", with seven rated HIGH. Most flaws live in the HTTP/2 and TLS layer your servers expose to the internet, and several are remotely exploitable with no authentication at all. But the catch: end-of-life lines like Node 20 "Iron" got nothing, and third-party trackers note a small discrepancy in the CVE count. Upgrade to a patched release if you're still running older code.

Node.js 26, 24, and 22 Get Major TLS and HTTP 2 Security Fixes @ Linux Compatible