Node.js Security Releases: Patched Versions by Release Line
Latest Node.js security releases: 26.12.1 for Node.js 26, 24.22.1 for Node.js 24 and 22.23.4 for Node.js 22. The latest LTS release is Node.js 26.13.0 (Lithium). This page lists each supported release line with its support phase, end-of-life date, latest release and latest security release, then the security releases of the past 12 months with their CVEs, severity, fixed versions and official advisories. It covers the Node.js runtime, not your npm dependencies.
Every Node.js version with its release date: Node.js versions and release dates. All our Node.js trackers and analysis: Node.js hub.
Node.js Versions and Security Releases by Release Line
| Release line | Support phase | End of life | Latest release | Latest security release |
|---|---|---|---|---|
| Node.js 26 (Lithium) | Active LTS | April 30, 2029 | 26.13.0 · October 28, 2026 | 26.12.1 · October 21, 2026 |
| Node.js 24 (Krypton) | Maintenance LTS | April 30, 2028 | 24.22.2 · October 27, 2026 | 24.22.1 · October 20, 2026 |
| Node.js 22 (Jod) | Maintenance LTS | April 30, 2027 | 22.23.4 · October 20, 2026 | 22.23.4 · October 20, 2026 |
These lines reached end of life in the past 12 months and get no more fixes, including security fixes:
| Release line | End of life | Last release | Last security release |
|---|---|---|---|
| Node.js 25 | June 1, 2026 | 25.9.0 · March 31, 2026 | 25.8.2 · March 24, 2026 |
| Node.js 20 (Iron) | April 30, 2026 | 20.20.2 · March 24, 2026 | 20.20.2 · March 24, 2026 |
Node.js Security Releases in the Last 12 Months
Newest first. Each release lists the CVEs that the Node.js Security Working Group records for it; those records can follow a release by days or weeks, so a new release may show its versions before its CVEs.
October 21, 2026: Node.js 26.12.1, 24.22.1 and 22.23.4
Fixed versions: 26.12.1 (Node.js 26), 24.22.1 (Node.js 24), 22.23.4 (Node.js 22). Official advisory: Wednesday, October 21, 2026 Security Releases. Our analysis: Node.js 26.12.1, 24.22.1 and 22.23.4: Security Fixes for TLS, DNS and Brotli.
| CVE | Severity | Issue | Fixed in |
|---|---|---|---|
| CVE-2026-105482 | High | dns.resolve truncates names containing NUL char | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-105483 | High | TLS certificate hostname bypass when the IP is written fullwidth digits | 26.12.1, 24.22.1 |
| CVE-2026-106069 | High | TLS certificate hostname bypass when the host loosely resolves to an IP address | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-111497 | High | Node.js Brotli decoder out-of-bounds write permits remote code execution | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-105481 | Medium | Keep-alive socket process a response that was written before the request was sent | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-106072 | Medium | Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-106074 | Medium | crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values | 26.12.1, 24.22.1, 22.23.4 |
| CVE-2026-106070 | Low | Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation | 26.12.1 |
| CVE-2026-106071 | Low | Permission Model filesystem over-grant via wildcard radix lookup | 26.12.1 |
| CVE-2026-106073 | Low | Permission Model bypass with fs.realpathSync | 26.12.1, 24.22.1, 22.23.4 |
July 29, 2026: Node.js 26.5.1, 24.18.1 and 22.23.2
Fixed versions: 26.5.1 (Node.js 26), 24.18.1 (Node.js 24), 22.23.2 (Node.js 22). Official advisory: Wednesday, July 29, 2026 Security Releases.
| CVE | Severity | Issue | Fixed in |
|---|---|---|---|
| CVE-2026-56846 | High | HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion | 24.18.1, 22.23.2 |
| CVE-2026-56848 | High | Re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv() causes heap-use-after-free in Node.js HTTP/2 | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58043 | High | Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-56850 | Medium | HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58040 | Medium | HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58041 | Medium | node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely | 26.5.1, 24.18.1 |
| CVE-2026-58042 | Medium | dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58045 | Medium | Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-56847 | Low | Permission Model Bypass: trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-write | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58039 | Low | Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths | 26.5.1, 24.18.1, 22.23.2 |
| CVE-2026-58044 | Low | HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser | 26.5.1, 24.18.1, 22.23.2 |
June 18, 2026: Node.js 26.3.1, 24.17.0 and 22.23.0
Fixed versions: 26.3.1 (Node.js 26), 24.17.0 (Node.js 24), 22.23.0 (Node.js 22). Official advisory: Thursday, June 18, 2026 Security Releases.
| CVE | Severity | Issue | Fixed in |
|---|---|---|---|
| CVE-2026-48618 | High | Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48933 | High | Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48615 | Medium | Proxy credentials leaked in ERR_PROXY_TUNNEL error message | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48619 | Medium | Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48928 | Medium | Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48930 | Medium | Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48934 | Medium | TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48937 | Medium | HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors | 24.17.0, 22.23.0 |
| CVE-2026-48617 | Low | Permission Model Bypass via process.report.writeReport() Path Misvalidation | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48931 | Low | HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48935 | Low | Permission Model bypass via FileHandle.utimes() in the promises API | 26.3.1, 24.17.0, 22.23.0 |
| CVE-2026-48936 | Low | Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix) (AIX, Android, macOS, FreeBSD, Linux, OpenBSD, SunOS only) | 26.3.1 |
March 24, 2026: Node.js 25.8.2, 24.14.1, 22.22.2 and 20.20.2
Fixed versions: 25.8.2 (Node.js 25), 24.14.1 (Node.js 24), 22.22.2 (Node.js 22), 20.20.2 (Node.js 20). Official advisory: Tuesday, March 24, 2026 Security Releases.
| CVE | Severity | Issue | Fixed in |
|---|---|---|---|
| CVE-2026-21637 | High | Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21710 | High | Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21711 | Medium | Node.js Permission Model bypass: UDS server bind/listen works without --allow-net | 25.8.2 |
| CVE-2026-21712 | Medium | Assertion error in node_url.cc via malformed URL format leads to Node.js crash | 25.8.2, 24.14.1 |
| CVE-2026-21713 | Medium | Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21714 | Medium | Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21717 | Medium | HashDoS in V8 | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21715 | Low | Permission Model Bypass in realpathSync.native Allows File Existence Disclosure | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
| CVE-2026-21716 | Low | CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown | 25.8.2, 24.14.1, 22.22.2, 20.20.2 |
January 13, 2026: Node.js 25.3.0, 24.13.0, 22.22.0 and 20.20.0
Fixed versions: 25.3.0 (Node.js 25), 24.13.0 (Node.js 24), 22.22.0 (Node.js 22), 20.20.0 (Node.js 20). Official advisory: Tuesday, January 13, 2026 Security Releases.
| CVE | Severity | Issue | Fixed in |
|---|---|---|---|
| CVE-2025-55130 | High | FS Permissions Bypass | 25.3.0, 24.13.0, 22.22.0, 20.20.0 |
| CVE-2025-55131 | High | Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled | 25.3.0, 24.13.0, 22.22.0, 20.20.0 |
| CVE-2025-59465 | High | Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame | 25.3.0, 24.13.0, 22.22.0, 20.20.0 |
| CVE-2025-59464 | Medium | Memory leak that enables remote Denial of Service against applications processing TLS client certificates | 24.13.0, 22.22.0, 20.20.0 |
| CVE-2025-59466 | Medium | Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers | 25.3.0, 24.13.0, 22.22.0, 20.20.0 |
| CVE-2026-21636 | Medium | Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) | 25.3.0 |
| CVE-2025-55132 | Low | fs.futimes() Bypasses Read-Only Permission Model | 25.3.0, 24.13.0, 22.22.0, 20.20.0 |
Check Your Node.js Version Against Published Fixes
- Run
node --versionwhere your application runs. - Find its release line in the table above: the first number of the version.
- If your version is lower than the latest security release of its line, upgrade at least to that release. Later releases of the same line carry the same fixes.
- If the line has reached end of life, move to a supported line: it gets no more fixes.
To check a version against every known Node.js vulnerability, not only the past year, the Node.js project publishes is-my-node-vulnerable: runnpx is-my-node-vulnerable. A check of the runtime does not audit your application or its npm dependencies.
Node.js Support Phases and End-of-Life Dates
- Current
- From the first release of a line until its LTS date, when the schedule gives one.
- Active LTS
- From the LTS date until maintenance starts.
- Maintenance LTS
- Critical bug fixes and security fixes until end of life.
- End of life
- No more releases, including security fixes.
- Node.js 26 (Lithium): LTS from October 28, 2026, maintenance from October 20, 2027, end of life on April 30, 2029.
- Node.js 24 (Krypton): LTS from October 28, 2025, maintenance from October 20, 2026, end of life on April 30, 2028.
- Node.js 22 (Jod): LTS from October 29, 2024, maintenance from October 21, 2025, end of life on April 30, 2027.
Dates come from the official release schedule; the Node.js Release Working Group can change future dates.
Node.js Security Release Questions
What is the latest Node.js LTS version?
Node.js 26.13.0, released October 28, 2026, on the 26.x line (Active LTS). The other supported LTS lines are Node.js 24 (24.22.2) and Node.js 22 (22.23.4).
When does Node.js 26 reach end of life?
On April 30, 2029, by the official release schedule. It is in Active LTS now.
When does Node.js 24 reach end of life?
On April 30, 2028, by the official release schedule. It is in Maintenance LTS now.
When does Node.js 22 reach end of life?
On April 30, 2027, by the official release schedule. It is in Maintenance LTS now.
Is the latest Node.js release always a security release?
No. Node.js 26.13.0 came after the security release 26.12.1 and Node.js 24.22.2 came after the security release 24.22.1; a later release of a line carries the fixes of the earlier ones. The table shows both columns for this reason.
Does an end-of-life Node.js line still get security fixes?
No. Node.js 25 reached end of life on June 1, 2026; its last release is 25.9.0. Node.js 20 reached end of life on April 30, 2026; its last release is 20.20.2.
Data Sources, Update Time and Coverage
- Node.js release index: every release, its date and whether it is a security release.
- Node.js Release Working Group schedule: support phases and end-of-life dates.
- Node.js Security Working Group records: CVE, severity and patched versions.
- Node.js vulnerability blog: official advisories and announced security releases.
Sources checked November 8, 2026; content last changed November 7, 2026. Code assembles this page from these sources without a language model; a run that fails a consistency check keeps the previous version. The fixed versions come from the security flag nodejs.org sets on each release, the CVE details from the Security Working Group records. The history covers the 12 months before the last check.
Spotted a mistake? Report a correctionor read the corrections policy.