Node.js Security Releases Address Multiple Vulnerabilities

On July 24, 2026, Node.js announced security updates for its 22.x, 24.x, and 26.x release lines. These updates address several vulnerabilities, including a flaw in the WebCrypto implementation that can crash the process with large inputs. Other issues include TLS hostname handling flaws that could lead to authentication bypass and exposure of proxy credentials in error messages. The vulnerabilities affect all supported release lines and have been reported by various contributors. The next security release is scheduled for July 27, 2026, to address additional high-severity issues. Users are urged to update to the latest versions to mitigate risks. The vulnerabilities have not been linked to any active exploitation at this time.

Key Points: • Node.js released security updates for versions 22.x, 24.x, and 26.x on July 24, 2026. • Critical vulnerabilities include WebCrypto flaws and TLS hostname handling issues. • A subsequent security release is planned for July 27, 2026, to address additional high-severity issues.