News · written 12 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

Node.js, the JavaScript runtime behind a great many web servers and developer tools, published security releases on 11 November 2026 for all three of its supported release lines:

• Node.js 26.13.1 (26.x)
• Node.js 24.22.3 (24.x)
• Node.js 22.23.5 (22.x)

The project's advisory lists 16 vulnerabilities: 7 High, 6 Medium and 3 Low. Not every issue affects every line; some are fixed only in 24.x and 26.x.

The High ones: HTTP/2 and TLS

All seven High-severity issues are in the code that serves HTTP/2 and TLS (HTTPS) connections. Among them, the advisory describes:

• an HTTP/2 client that can crash the server without signing in;
• HTTP/2 sessions that are not cleaned up after a protocol error, leaking memory and file descriptors;
• memory-safety bugs where freed memory could be written back to the other side of a connection;
• a TLS 1.2 renegotiation trick that could get around client-certificate sign-in.

If you run a Node.js server that speaks HTTP/2 or HTTPS directly, these are the reason to update now.

The rest

The Medium and Low issues include proxy credentials showing up in an error message, TLS sessions reused across different certificate rules, and gaps in the Permission Model. The releases also update the bundled HTTP parser, llhttp, to 9.4.4. The release posts list one more Low fix — a Permission Model check on where heap snapshots are written — that the advisory itself does not.

The advisory adds that End-of-Life versions are always affected when a security release occurs.

What to do

Move to the patched version for your line — 26.13.1, 24.22.3 or 22.23.5 — through however you install Node.js (the official downloads, a version manager or your system's packages), then restart your apps. If you are still on a release line that is no longer supported, plan the move to one that is.

Sources

• Node.js blog — Wednesday, November 11, 2026 Security Releases
• Node.js blog — release posts for v26.13.1, v24.22.3 and v22.23.5 (11 November 2026)

More news and guides at https://jmtechpower.com/articles.