Node.js releases emergency security update fixing 11 vulnerabilities

The Node.js project issued an emergency security release on July 29, 2026, providing updated versions v22.23.2, v24.18.1 and v26.5.1 for all active release lines. The patch addresses ten to eleven CVEs, including three high‑severity flaws.

Key high‑severity issues fixed are two HTTP/2 vulnerabilities (CVE‑2026‑56846 and CVE‑2026‑56848) that could allow memory‑limit bypass or a heap use‑after‑free, and a permission‑model flaw (CVE‑2026‑58043) that permits path‑traversal outside the intended filesystem allowlist. Additional medium‑severity fixes cover DNS response handling, TLS session reuse, Zlib API crashes, SQLite handling, and updates to the bundled Undici and llhttp dependencies.

The release was delayed by a day due to infrastructure problems, but developers are urged to upgrade immediately and review the full advisory before restarting services.