Node.js shipped another coordinated security update today — the second HIGH-severity release in six weeks. All three active lines are affected: 22.x, 24.x, and 26.x. If you skipped June’s patch, you’re now two rounds behind. If you’re still on Node.js 18 or 20, no patch is coming. Read on.
What’s Confirmed
The Node.js project pre-announced the release on July 25 and held the CVE details under its standard embargo until release day. What’s confirmed: the maximum severity across all three active lines is HIGH. That’s the same tier as June’s TLS wildcard bypass and WebCrypto DoS — not low-hanging-fruit vulnerabilities.
Full details are on the official Node.js July 27 security releases page. Specific CVE numbers and patched version strings appear there as the release drops. Check it before doing anything else.
Version Matrix: Who Patches, Who Upgrades
| Version | Status | Action |
|---|---|---|
| 26.x | Current | Patch — update to the new minor release |
| 24.x | LTS Active | Patch — update to the new minor release |
| 22.x | LTS Active | Patch — update to the new minor release |
| 20.x | EOL since April 2026 | No patch. Upgrade to 22 or 24. |
| 18.x and earlier | EOL since April 2025 | No patch. Upgrade immediately. |
Node.js is explicit about this: “End-of-Life versions are always affected when a security release occurs.” That means every HIGH CVE in today’s release applies to Node 18 and 20. No fix is coming for those versions. Your SCA scanner will start surfacing the runtime itself as an unfixable finding.
What June Taught Us About the Pattern
If you want to calibrate severity expectations, the June 18 security release is the closest reference. It fixed 12 CVEs — 2 rated HIGH:
- CVE-2026-48933: WebCrypto AES integer overflow. Input to
subtle.encrypt()that’s a multiple of 2 GiB overflows the cipher output length calculation, crashing the process. Remote denial of service. - CVE-2026-48618: TLS wildcard bypass via Unicode dot separators. The resolver and certificate validator normalize hostnames differently — an attacker can exploit that gap to bypass wildcard certificate restrictions.
Beyond those two, June’s release addressed proxy credential leaks in error messages, HTTP/2 unbounded memory growth, TLS session reuse bypass, and three permission model bypasses. The dependency chain got bumped too: llhttp 9.4.2, nghttp2 1.69.0, and OpenSSL 3.5.7.
Two coordinated HIGH-severity releases in six weeks isn’t bad luck. It’s a signal. Node.js has systematic exposure in TLS and HTTP/2 that’s being addressed incrementally. Budget for a quarterly patch cadence, not an annual one.
How to Patch
Once the patched version numbers land on nodejs.org, the upgrade is straightforward. Here’s the approach with nvm:
# Check what you're running
node -v
# Install the patched version (replace with actual released version)
nvm install 26
nvm use 26
nvm alias default 26
# Confirm
node -vFor Docker-based deployments, bump the base image tag to the patched minor release in your Dockerfile and rebuild. For AWS Lambda, check the runtime version and update accordingly. Don’t forget CI pipelines — GitHub Actions and similar systems often pin Node.js versions explicitly in workflow files and those pins silently become stale.
What to Do Right Now
The patches drop July 27. Today’s job is to inventory, not wait. Run node -v across every service, container, CI image, and Lambda in your infrastructure. Flag anything on 18.x or 20.x — those need a major version upgrade, not a minor bump. For everything on 22.x, 24.x, or 26.x, prepare for a fast minor-version deploy once the patched versions are published.
Subscribe to nodejs-sec for low-volume security announcements so future releases don’t catch you off guard. The Node.js release schedule shows exactly when each line hits EOL — plan upgrades ahead of deadline rather than scrambling after.
The CVE details are sealed until today. When they drop, the risk picture will be clearer. But the pre-announcement already tells you enough: HIGH severity, all active lines, no patch for EOL users. Treat this as urgent.
