Node.js Security Release Nov. 11: HIGH Fix, No CVEs Yet

Node.js will ship security releases for its 22, 24 and 26 lines on or shortly after Wednesday, Nov. 11, 2026, and the highest-severity bug in the batch is rated HIGH. That's the whole announcement so far. The project's security release page names no CVEs, no components and no fixed version numbers.

A heads-up, not a patch

The notice went out Nov. 4 as a pre-alert, posted to the oss-security list by Antoine du Hamel. It exists so teams can plan a window, nothing more. Until Nov. 11 there is nothing to install, and the wording "on or shortly after" leaves room for the date to slip.

Three lines, one rating

The page repeats the rating for each line: the highest-severity issue is HIGH in 26.x, in 24.x and in 22.x. It doesn't say whether that's one bug or three, or whether every line is affected by the same flaw.

It does add one standing rule: end-of-life versions are always affected when a security release ships. The release table lists Node.js 20 as end-of-life, last updated Mar. 24, 2026, so it isn't among the lines being patched.

Don't mix it up with October

It's easy to blur two separate announcements. The earlier batch landed Oct. 21 in Node.js 22.23.4, 24.22.1 and 26.12.1, and it was detailed: 10 CVEs, four high, three medium, three low. One of the high ones, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that the advisory says can lead to a crash, memory disclosure or remote code execution.

Nothing published says CVE-2026-111497 or any other October bug is part of November's batch.

What October's table suggests

Three of October's entries build on earlier CVEs, and one of them, a permission-model bypass through fs.realpathSync(), is called an incomplete fix of CVE-2026-21715 in the project's own advisory. A HIGH rating is a reason to schedule a window, not to guess at the bug.

Before Wednesday

Run node -v on every service and CI image. If you're on 20 or earlier, no patch is coming. If you're on 22, 24 or 26, note which image or runtime pins each version, since a pinned base image won't pick up a patch by itself. The project also runs a low-volume, announcement-only nodejs-sec mailing list, which the project points to for security releases.

Source: Node.js, Wednesday, November 11, 2026 Security Releases

nodejs node js security security release cve javascript

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.