On July 21, the Node.js team announced via its official blog that security patches are arriving on Monday July 27 for three active versions at once: 26.x, 24.x and 22.x. All three are rated HIGH severity. Specific CVE identifiers and attack vector details will be published only when the patches land — the same advance-notice model that Next.js adopted for framework releases, now applied to the JavaScript runtime itself.
Three release lines, one vulnerability
It is unusual for Node.js to patch three release lines simultaneously. 22.x is in Maintenance LTS, 24.x is Active LTS, and 26.x is Current. All three being affected at once suggests the vulnerability lives in shared runtime core code, not in anything specific to one version's additions. End-of-life versions such as 20.x and older are also exposed, but will not receive an official patch — that is the permanent consequence of running on a line whose support window has closed.
What it means for your project
Node.js is not an ordinary dependency. It is the runtime every JavaScript build, every CI job and every server process runs on. A HIGH severity vulnerability in the runtime reaches further than a bug in an application framework. Check which Node.js version you are running now — locally, in Docker, in CI. Make sure your version pins are loose enough to accept a security update, and prepare your update path so you can act quickly once the patches arrive on July 27.
Our take
Advance notice has become the norm. The Node.js team announces patches before the CVE details go public — just enough of a lead to prepare, without giving attackers a roadmap. If you are still running an end-of-life version, this announcement is a stronger prompt to migrate than any feature list ever was.
