Node.js warns administrators that urgent patches for all three supported versions are coming on Wednesday
At least one high-severity vulnerability will be fixed in each of the 22.x, 24.x and 26.x lines, with details only due at release time.
The Node.js project will ship security updates for the supported 22.x, 24.x and 26.x versions on or shortly after Wednesday 11 November. Each of the three lines will get a fix for at least one high-severity vulnerability, according to the advance notice on the official website. Antoine du Hamel sent the warning to the oss-security mailing list last Wednesday, FOSS Linux reports.
Details are still missing: no CVE numbers, counts or affected components have been disclosed, Cyber Security News stresses. The project repeats that versions no longer supported are always affected when such a security round takes place, so moving to a supported line is the only real fix. Node.js 26.x is the active LTS version, while 24.x and 22.x receive maintenance updates.
It is the second round in a short time. Updates for the same three lines already came out on 21 October, including a fix for a serious flaw in the built-in Brotli decoder that could lead to a crash, leaked memory or code execution when unpacking malicious data. FOSS Linux advises administrators to check their versions and container images now so they can rebuild them straight away on release day.