The Node.js project will ship security releases for its 26.x, 24.x and 22.x lines on or shortly after Wednesday, November 11, and the most serious fix in each line is rated High.
The Node.js advance notice, last updated November 3, gives no vulnerability count, CVE IDs, affected components or fixed version numbers. It also warns that end-of-life versions are always affected when a security release occurs, which puts Node.js 20 and Node.js 25 in scope with no fix coming.
The notice comes three weeks after the October 21 security release, which fixed 10 vulnerabilities, including the Brotli decoder flaw known as Node2Shell. Public exploit code for that bug is already circulating, so servers still missing the October update have a more immediate problem than next week’s fixes.
As of November 4, no patched builds for the November issues are available, and Node.js has not said whether any of them are being exploited.
What the Node.js Notice Does and Does Not Say
The Node.js notice confirms only that the highest-severity issue in each of the three release lines is High. It does not say how many flaws are being fixed, or whether one bug spans all three lines or each line has its own.
The silence is standard practice. Under the Node.js security policy, fixes stay out of the public repository until the embargo date, when the project emails its security list, pushes the changes and deploys new builds. The blog advisory follows within six hours, while CVE records can take a few more days because disclosure runs through HackerOne.
The High label alone says little about exposure. In the July 29 release, it covered an HTTP/2 heap use-after-free and a filesystem over-grant that applied under the opt-in --permission flag. In October, Node.js gave the same rating to Node2Shell, which the CVE record scores at 9.2 (Critical) under CVSS 4.0, according to Sysdig.
The November 11 date may also move. The July release was postponed twice, first for additional testing and then for infrastructure issues, before landing on July 29. The June release was announced for June 17 and shipped on June 18.
Why the October Node2Shell Patch Comes First
Node2Shell, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js. An invalid block switch was treated as a temporary need for more input, so the streaming decoder kept appending bytes to an eight-byte internal buffer. Node.js says the result can be a crash, process memory disclosure or remote code execution.
Sysdig says Express 5 applications using express.json() decode Brotli request bodies by default, and server-side fetch() decodes Brotli responses from attacker-influenced URLs. Express 4 body parsing and bare Node.js HTTP servers do not decode Brotli request bodies on their own. Sysdig put the gap between the patch and public proof-of-concept code at about a day.
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27 with a federal remediation deadline of November 10, the day before the planned Node.js release.
The fixed October builds are Node.js 26.12.1, 24.22.1 and 22.23.4. Node.js 26.13.0, released October 28, moved the 26.x line to Long Term Support under the codename Lithium and changed only release metadata from 26.12.1, so it carries the same fixes.
Nothing in the November notice links the new fixes to Node2Shell. The October batch did show how often this code gets revisited: three of its 10 fixes were labelled incomplete fixes of earlier CVEs, and a fourth was a regression introduced after an earlier fix.
What Node.js Users Should Do Before November 11
Node.js lists no workaround for the November issues, and none can be assessed until the affected components are named. Teams can still run node --version across production hosts, containers and CI runners to confirm each one is on at least the October builds. Base images pinned to a specific version will not pick up the new fixes until they are rebuilt.
Node.js 20 and Node.js 25 will not receive new releases. The Node.js end-of-life page shows their last updates on March 24 and March 31, respectively, and names HeroDevs, NodeSource and TuxCare as commercial sources of security fixes for retired lines. Node.js calls that route a temporary measure.
Teams moving up should check the target line’s support window on the Node.js release schedule. Node.js 22 reaches end of life on April 30, 2027, while Node.js 26 will receive updates through the end of April 2029. The 26.13.0 release notes warn that official Linux binaries have linked against libatomic since Node.js 25, so anyone jumping from 22 or 24 may need to install that library separately.
Final CVE details and download links will appear on the Node.js advisory page and through the nodejs-sec mailing list, the project’s announcement-only security channel.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
