Node.js ships security releases for 26.x, 24.x and 22.x

The Node.js project has announced new releases for the 26.x, 24.x and 22.x lines on or shortly after Monday, 27 July 2026, addressing security vulnerabilities. This follows the previous security release round of 18 June 2026.

The advisory does not detail the individual vulnerabilities, but it is explicit about impact: the highest severity issue fixed in this round is HIGH, and that HIGH rating applies to all three of the 26.x, 24.x and 22.x lines.

Key points

• Three affected lines: 26.x, 24.x and 22.x — covering both Current and the supported LTS lines.
• Severity: HIGH across all three lines, which is enough to warrant prioritizing the patch in your rollout schedule.
• End-of-Life versions are always affected: Node.js stresses that EOL versions are always affected when a security release occurs. If you still run an EOL Node, the only fix is moving to a supported line per the Release Schedule.
• What to do: audit the Node version in your Docker images, CI runners and production environments, then update to the patched release for your line.
• Stay informed: the project recommends subscribing to the low-volume nodejs-sec announcement mailing list for vulnerability and security-release notices.