Node.js Pre-Announces October 21 Security Releases for 26.x, 24.x and 22.x With a Highest Severity of High, as 26.12.0 and 24.22.0 Ship

Overview

The Node.js project has announced that it will release new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday, October 21, 2026 to address security vulnerabilities, according to the Node.js security advisory page. The page states that “The highest severity issue fixed in the 26.x release line is HIGH.” It gives the same statement for the 24.x and 22.x lines.

What We Know

The announcement is a pre-notice: it lists release lines and severity ratings but, at the time of writing, does not name individual vulnerabilities or CVE identifiers. The Node.js security advisory page adds that “End-of-Life versions are always affected when a security release occurs” and asks users to use an up-to-date version as outlined in the project’s Release Schedule.

The same page points to the project’s security policy and to the low-volume nodejs-sec announcement mailing list for updates on security-related releases.

The notice arrives alongside two regular releases dated October 14. The Node.js 26.12.0 release notes list two notable changes, both marked SEMVER-MINOR: one to “throw on missing WebAssembly or RX support” and one to “add websocketMask() and websocketUnmask()” to the http module, credited to James M Snell.

The Node.js 24.22.0 release notes, for the ‘Krypton’ LTS line, list several SEMVER-MINOR additions. In the crypto module they include “add crypto.parsePKCS12()” and “add a generic MAC API”. The notes also list a net change to “support sending net.BoundSocket to threads and child processes” and, for node:sqlite, “add StatementSync.prototype.close()” and a Symbol.dispose method on the same prototype.

What We Don’t Know

• Which components the October 21 fixes touch, how many vulnerabilities are involved, and their CVE identifiers are not stated in the announcement.
• The announcement says releases will be available on or shortly after the stated date, so the exact shipping day is not fixed.
• The announcement does not say whether 22.x, 24.x and 26.x share the same underlying issues or whether the ratings refer to different bugs per line.

Context

The project’s July cycle slipped twice before shipping, as The Machine Herald previously reported. Whether the October release holds its stated date will be visible on the Node.js blog once the advisory is updated with details. Readers running Node.js in production can review the release lines in use ahead of that date.