Node.js HIGH-Severity Patches Are Out — Update Now

Node.js shipped HIGH-severity security patches today for all three active release lines — 22.x, 24.x, and 26.x. The November 11 advisory was pre-announced on November 3 to give teams time to plan. The patches are live. If you haven’t updated yet, today is the day. And if you’re running Node.js 20 or older: there is no fix coming — which is a different kind of problem.

What the November 11 Release Covers

The official advisory confirms HIGH-severity fixes across all three supported lines. The Node.js team withholds CVE IDs and technical details until patches ship — their standard embargo practice to prevent exploitation before teams can respond. Full details are on the advisory page now that the release is live.

Worth noting: Node.js 26.x (Lithium) only entered Long Term Support on October 28 — two weeks ago. This is its first security release as an LTS line. November patches cover 26.x, 24.x, and 22.x (Maintenance LTS).

EOL Versions Are Affected — and Getting Nothing

The Node.js project’s standing policy is unambiguous: end-of-life versions are always affected when a security release occurs, and no patches ship for them. Node.js 20.x, 25.x, and anything older is exposed to the same HIGH-severity issues with no official fix on the way.

Node.js 20 is still running in a lot of production environments. If that’s you, this isn’t a patch situation — it’s a migration. Node.js 24.x LTS is supported through mid-2027; if you’re stuck on 20, that’s your target. The Node.js release schedule has the full EOL timeline.

Where Node.js Is Actually Running

Most teams immediately check their app servers. That’s the easy part. The harder part is the Node.js running everywhere else:

• Container base images — a Docker restart does not patch you. The base image needs to be rebuilt. FROM node:24 in your Dockerfile won’t update until you run docker build again with a fresh pull.
• CI/CD pipelines — GitHub Actions runners, Jenkins agents, and build scripts that install Node.js separately may still be pinned to a vulnerable version.
• Serverless runtimes — AWS Lambda, Vercel, and Netlify let you pin a Node.js runtime version. Check your project config.
• Build tools — webpack, Vite, and Turborepo run on Node.js during builds, often on a separate cloud runner that doesn’t get patched with your app servers.

A quick audit before you patch:

node -v
nvm ls
grep -r "FROM node" Dockerfile*

What HIGH Severity Actually Means in Node.js

The October 21 release provides useful context. It fixed 10 CVEs, four rated HIGH. The headline was CVE-2026-111497 (Node2Shell) — an out-of-bounds write in the Brotli decoder that can lead to remote code execution. Any app using Express 5 with body-parser, the fetch() API, or node:zlib Brotli functions on untrusted input was potentially exploitable. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 10 — yesterday.

Three separate TLS/hostname bypass bugs also shipped in October, suggesting active scrutiny of how Node.js handles certificate validation. That scrutiny clearly hasn’t stopped, which explains why we’re back here five weeks later with another HIGH-rated round.

How to Patch

Update to the latest patch version of your release line:

# With nvm
nvm install 24 --reinstall-packages-from=24
nvm alias default 24

# Ubuntu/Debian
sudo apt update && sudo apt upgrade nodejs

# Verify
node -v

For Docker: update your base image tag and rebuild. For serverless: update the runtime version in your project config and redeploy. For Node.js 20 teams: the target is 24.x LTS, supported through 2029.

Subscribe to the nodejs-sec mailing list to get the pre-alert one week before the next release. The October and November 2026 cadence makes clear that HIGH-severity findings in Node.js core are not rare. Treat the nodejs-sec notice the same way you’d treat Patch Tuesday — it’s a calendar event.