On October 21, 2026, Node.js released a coordinated security update that patched ten vulnerabilities across its three supported versions: v26.12.1, v24.22.1, and v22.23.4. Among these vulnerabilities, four were rated High, including a significant Brotli decompression flaw (CVE-2026-111497) that could allow remote code execution, particularly affecting applications that utilize fetch() or Express 5. This update marks a significant change as it is the last release under Node's previous versioning model, transitioning to a new annual release cycle starting with Node 27 in 2027. Users running older, unsupported versions such as Node 20 and Node 25 are urged to upgrade to the latest versions as no security fixes will be provided for those
Node.js October 2026 Security Update: 10 Vulnerabilities Patched Across 3 Release Lines
Node.js shipped a coordinated security release on October 21, 2026, patching ten vulnerabilities across all three supported lines at once, v26.12.1, v24.22.1, and v22.23.4. Four of those are rated High, headlined by a Brotli decompression flaw (CVE-2026-111497) that enables remote code execution and is easy to trigger since fetch() and Express 5 auto-decompress Brotli responses. The release also carries a second meaning, landing the day Node abandons its two-majors-a-year model in favor of one annual, year-numbered release starting with Node 27. With Node 20 and Node 25 already end-of-life and no fixes coming, teams are urged to upgrade to 22.23.4, 24.22.1, or 26.12.1 and rebuild any container or snapshot that embeds the runtime.
