Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
26.10.0
RELEASE PATCH Node.js & npm Node.js · released September 22, 2026 · covered September 22, 2026

Node.js 26.10.0 Released

Node.js 26.10.0 has been published on the official release channel. The accompanying release notes were not detailed in the source material, so this update should be treated as a routine release until the full changelog is reviewed.

Version 26.10.0 Node.js 26 release line Details pending official changelog
AI summary

Node.js 26.10.0 has been released and published on nodejs.org. Node.js 26 is a current release line, and point releases like this one typically bundle a mix of bug fixes, dependency updates, and minor improvements. No specific list of changes was included in the available release notes for this version.

What we know about this release

The release package for Node.js 26.10.0 confirms the version number and publication date but does not include a detailed changelog or list of specific fixes. Teams that depend on precise release content — for example, to assess whether a particular bug or behavior change affects their application — should consult the official release notes at nodejs.org directly before drawing conclusions about what changed.

How to update

Node.js can be updated through your usual installation method: via a version manager such as nvm or fnm, through official installers and package archives from nodejs.org, or via your operating system's package manager if it tracks upstream releases. Projects using containerized environments should bump the base image tag accordingly. As with any Node.js update, it's good practice to run your test suite and verify compatibility with native addons or dependencies that are sensitive to runtime version changes before rolling out to production.

Staying informed

Because this release's specific contents weren't detailed in the available source material, site owners and developers who need certainty about security fixes, deprecations, or breaking changes should check the official Node.js release notes and the Node.js security release blog directly. Subscribing to the Node.js release announcements is a reliable way to catch details that may not yet be reflected in secondary summaries.

Synthesized by AI from 1 source · updated 1 hour ago
Sources · merged by AI 1 total
notes ↗
LOW 2.5 Node.js & npm 10 Oct fast-jwt: Verifier cache accepts expired JWTs (CVE-2026-107719) fast-jwt's createVerifier cache can accept a previously valid signed JWT after its exp time when caching is enabled and the token has exp but no iat. The issue is fixed in 6.3.4. (Sources: OSV, NVD) Read full report → LOW 2.8 Node.js & npm 10 Oct msgpack5: Decoding negative int64 mutates input buffer (CVE-2026-107296) msgpack5 updates to 6.1.0 fix an issue where decoding a negative signed 64-bit integer can overwrite bytes in the caller-provided input buffer, causing silent corruption of retained or reused encoded data. (CVE-2026-107296, GHSA-qw35-55vc-rhgj) Read full report → LOW 3.4 Node.js & npm 10 Oct fast-jwt: clockTolerance = Infinity bypasses exp/nbf and persists in verifier cache (CVE-2026-107721) fast-jwt accepted Infinity for clockTolerance, letting exp and nbf checks always pass and allowing expired or not-yet-active JWTs to be accepted. Verifier cache entries created under that configuration can remain valid until eviction. The issue is fixed in 6.3.0. [CVE-2026-107721, GHSA-687g-22h4-j4w4] Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email