Node.js November 11 Security Release: What to Do Before It Lands

The Node.js project has pre-announced a security release for the 22.x, 24.x and 26.x lines, due on or shortly after Wednesday, November 11, 2026. The highest severity issue is rated HIGH. That is all that was public before the patched versions shipped.

If you run Node.js servers, workers or Docker images, here is what is confirmed, what is not, and how to be ready the day the patch lands.

What has Node.js officially announced?#

Two official sources carry the announcement: the November 11, 2026 security releases page on nodejs.org, and the pre-alert posted to the oss-security mailing list on November 4, 2026.

The release time is not stated, so "shortly after" can mean a delay of a day or more. Node.js has done this before, so do not schedule a hard deadline around the 11th.

Why does a pre-alert exist?#

Security releases are coordinated. The project tells users that a patch is coming so they can plan an upgrade window, without revealing details that attackers could use before fixes are available. The pre-alert gives you the lines and the maximum severity, nothing more.

What about end-of-life versions?#

The official page is direct about this: end-of-life versions are always affected when a security release occurs, and you are told to use an up-to-date version from the release schedule. In practice, if you still run Node.js 20.x or older, there will be no patch for you. Upgrading is the only fix.

Do not assume an old line is safe because it is not named in the announcement.

Are you on the last patch release?#

The previous release, October 21, 2026, fixed these versions:

That page lists 10 CVEs: 4 High, 3 Medium and 3 Low. The High issues included DNS name truncation, two TLS hostname-verification bypasses and a Brotli decoder out-of-bounds write described as permitting remote code execution. Check the page for the full list and affected lines.

If you are not on those versions yet, update now. Do not wait for November 11 to also catch up on October.

How do you check your versions?#

Check every place Node runs, not only your laptop:

node --version
docker run --rm your-image:tag node --version

Also check CI runners, serverless runtimes and any base images pinned in a Dockerfile. Our guide on Node 24 vs Node 26 helps if you are still choosing a line.

How do you prepare Docker images?#

Pin a major.minor tag you control rather than a floating latest, then bump it when the patch ships:

# Bump this on release day, then rebuild with --no-cache
FROM node:24-alpine

A cached base layer will keep the old Node binary. Rebuild with --pull or --no-cache so you actually get the new image. If you build Next.js apps, see our Next.js Dockerfile guide for a production setup.

What should you do on release day?#

1. Read the official advisory page for exact versions, CVEs and affected lines.
2. Check whether the issues touch features you use, such as TLS, HTTP, or the permission model.
3. Update the runtime in staging, run your tests, then deploy.
4. Rebuild container images without cache and redeploy.
5. Confirm with node --version in running production containers.

Node.js 22 and later also include other security-relevant surfaces. If you run public APIs that fetch user-supplied URLs, review SSRF protection in Node.js while you are patching.

What is still unknown?#

• The exact version numbers.
• The number of vulnerabilities and their CVE IDs.
• Which components are affected (for example HTTP, TLS or a bundled dependency).
• The exact release time on or after November 11.

None of these are in the pre-alert. Treat any article that lists CVEs before the official page does with suspicion.

Key takeaways#

• A Node.js security release for 22.x, 24.x and 26.x is planned on or shortly after November 11, 2026, with a HIGH maximum severity.
• Details are embargoed, so prepare rather than speculate.
• End-of-life lines will not be fixed, so upgrade them.
• Get onto the October 21 patch versions first.
• Rebuild Docker images without cache on release day and verify the running version.

Source: the official Node.js November 2026 security releases page.