Node.js patches 10 security vulnerabilities across all active release lines
Node.js just shipped security patches for three active tracks: v22.22.2, v24.18.1, and v26.5.1. The releases drop today, July 29, 2026, after the project delayed the announcement twice. Originally targeted for July 28, infrastructure hiccups pushed the final build out by a full day.
If you're running anything from the current 26.x line down to the maintenance LTS in 22.x, you need to update immediately. The team fixed 10 CVEs across HTTP/2, mutual TLS, DNS, compression, embedded SQLite, and the --permission sandbox model. Three of them hit high severity. Two of those are HTTP/2 bugs that could let a remote attacker crash your process or potentially execute code.
The permission model keeps getting tested
Three of the ten patches target the --permission flag, which has been Node.js's attempt at running untrusted code in a sandbox. The highest severity one, CVE-2026-58043, shows how a process granted access to a single directory can abuse radix-tree prefix matching to read or write outside that allowlist. It's not a theoretical edge case. The reporter, sy2n0, walked through a practical path traversal that bypasses the filesystem whitelist entirely. Two lower-severity bugs let trace events and process reports write logs to arbitrary locations on disk. Keep in mind that if you rely on the permission model for multi-tenant runtimes or serverless containers, this is the patch you actually need to prioritize.
The HTTP/2 bugs are probably going to make network teams nervous. CVE-2026-56848 is a heap-use-after-free in the nghttp2_session_mem_send() function. An attacker can trigger re-entrant calls while recv() is still processing, which means remote code execution is on the table. Meanwhile, CVE-2026-56846 lets retained header blocks slip past the maxSessionMemory cap, leaving your session vulnerable to memory exhaustion. That one only lands in the 24.x and 22.x lines, which tells you the 26.x HTTP/2 stack already got the upstream fix. Matteo Collina has been tweaking the nghttp2 bindings for years, and this patch looks like the payoff of that long-running cleanup effort.
DNS and compression round out the medium-severity fixes. dns.resolveAny() crashes the entire process if a response contains more than 256 A records. Repeated requests from untrusted input will fry your server. The node:zlib synchronous APIs have a similar issue, this time triggered by a spoofed TypedArray.byteLength. Same result, different vector. Both are denial-of-service flaws, but they're trivially exploitable by anyone who can influence DNS responses or hand your server malformed buffers.
Version tracking and what's next
Each major line ships with its own version of undici, the HTTP client that powers fetch and Node's request handling. Node 22 gets undici 6.28.0, Node 24 gets 7.29.0, and Node 26 gets 8.9.0. The split is by design, but it does mean you can't just grab one undici patch and expect it to cover every deployment. The llhttp parser also got bumped to 9.4.3 across the board.
All 10 vulnerabilities were found by independent researchers. The fixes mostly came from Matteo Collina and Rafael Gonzaga, with Marco Ippolito shepherding the v22 build. It's a pretty standard community-driven disclosure flow, which speaks to the project's security posture. The two-day delay before publication actually suggests the team wasn't rushing. They ran validation. Caught an infrastructure snag. Shipped when the build was clean.
If you're on any active release line, pull the new version today. PGP signatures and SHASUMS are available on each release page if you care about build integrity. The 26.x line is still the safest bet for new deployments, though upgrading your existing stacks is far more important than starting fresh. Head here to review the full July 2026 security advisory before you restart your services.
Node.js — Node.js 22.23.2 (LTS)
Node.js
is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js — Node.js 24.18.1 (LTS)
Node.js
Node.js — Node.js 26.5.1 (Current)
Node.js
