The 26.x, 24.x, and 22.x lines all get fixes on Wednesday, and the project says the highest severity issue is HIGH.
Node.js will publish security releases for the 26.x, 24.x, and 22.x lines on Wednesday, October 21. The project's October 14 notice says the highest severity issue in the release is HIGH, and that builds will be available on or shortly after that date.
The notice does not publish the CVE details yet. That is normal for a pre-release security announcement: the specifics land with the patched builds, which gives attackers less time to study an exploit before teams can update. Treat Wednesday as a patch window, not a research task.
Frontend teams feel this through the toolchain even when the app runs in a browser. Vite, Next.js, test runners, and CI images all execute on Node, and a HIGH severity issue in the runtime can sit under every one of them. Check which lines your local machines, CI matrix, and deployment images use. Node 26, 24, and 22 are all in scope, so one pinned CI image can leave a line unpatched.
Put the release on the calendar, then read the advisory before you upgrade. Verify whether native addons need a rebuild. If you maintain a shared base image, publish the patched digest the same day so downstream teams do not each rebuild the wheel.
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
1 source
CVE-2026-42826 lets unauthenticated attackers extract sensitive data from Azure DevOps with zero user interaction. CVSS score of 10.0, the highest possible. Here's what's exposed and how to check if you're patched.
2 sources
Vite patches CVE-2026-39363 (arbitrary file read via dev server WebSocket) and CVE-2026-39364 (server.fs.deny bypass), affecting versions 6.x, 7.x, and 8.x. Fixed in 6.4.2, 7.3.2, and 8.0.5.
2 sources