Node.js Patches Three Active Release Lines
A coordinated release fixes a Permission Model bypass and several TLS, DNS, and core-module issues across Node.js 26.x, 24.x, and 22.x.
The Node.js project shipped coordinated security releases across its 26.x, 24.x, and 22.x lines on July 29, 2026, publishing updated builds 26.5.1, 24.18.1, and 22.23.2. All three lines received the same set of fixes, which is standard practice for Node.js when a vulnerability affects code shared across active release lines.
The most notable fix closes a vulnerability in the Permission Model, the opt-in sandboxing system Node.js added to restrict what a running process can access. The flaw could let code escape the configured allowlist and reach filesystem paths that should have been off-limits, which matters most to teams using the Permission Model as an actual security boundary rather than a development aid.
The release also addresses issues in the HTTPS Agent affecting mTLS identity and TLS session reuse, along with fixes across DNS resolution, the built-in SQLite module, zlib compression, HTTP header size limits, trace events, and diagnostic report file paths. Node.js also pulled in security-related updates to two dependencies it bundles directly: the Undici HTTP client and the llhttp parser.
None of the individual issues were rated above High severity, but the breadth of the fix set is a reminder that a single coordinated release can touch several unrelated subsystems at once. Teams running any of the three affected lines in production are encouraged to update rather than wait for the next scheduled release.
Node.js maintains multiple release lines at once specifically so teams don't have to choose between new features and long-term stability: 22.x and 24.x are both Long Term Support lines aimed at production use, while 26.x is the Current line on track to become the next LTS once it matures. Because all three lines shared the same underlying vulnerable code, the project patched and published them together rather than staggering the fixes across separate releases.
Node.js publishes every security release, along with the specific CVEs and affected versions, on its own vulnerability blog, and maintains a low-volume, announcement-only mailing list for teams that want advance notice of security-related releases.