Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
26.11.0
RELEASE PATCH Node.js & npm Node.js · released October 7, 2026 · covered October 7, 2026

Node.js 26.11.0 Released

Node.js 26.11.0 has been published on the Node.js release line. No detailed release notes were provided with this announcement, so site owners and developers should consult the official changelog before upgrading.

Node.js 26.x line Version 26.11.0 Details pending official notes
AI summary

Node.js 26.11.0 has been released as part of the ongoing maintenance of the Node.js 26 line. This announcement did not come with detailed release notes, so the exact scope of changes in this build is not yet known from the information available here. Teams running Node.js 26 should treat this as a routine update pending review of the official changelog.

What we know so far

This release package does not include specific notes about what changed in 26.11.0 — no listed bug fixes, new features, or security advisories were provided. Node.js release announcements of this kind typically correspond to the project's regular release cadence, which includes periodic builds for both Current and Active LTS lines. Until the official release notes are reviewed, it's not possible to say whether this update includes dependency bumps, V8 engine updates, npm updates, or targeted bug fixes.

How to update

As with any Node.js release, you can install 26.11.0 using your existing version manager (such as nvm, fnm, or volta) by running the equivalent of 'install 26.11.0' and switching your active version. Docker users relying on official Node.js images should pull the updated tag once it's published. Before rolling this out to production, review the official release notes at the provided source link to confirm there are no breaking changes or behavior shifts relevant to your application.

Recommended next step

Because this announcement lacks itemized details, we recommend checking the official Node.js blog post directly for the full list of commits, fixes, and any security-relevant content before deciding on urgency. If the official notes reveal security fixes, this release should be re-evaluated and prioritized accordingly.

Synthesized by AI from 1 source · updated 1 hour ago
Sources · merged by AI 1 total
notes ↗
LOW 2.5 Node.js & npm 10 Oct fast-jwt: Verifier cache accepts expired JWTs (CVE-2026-107719) fast-jwt's createVerifier cache can accept a previously valid signed JWT after its exp time when caching is enabled and the token has exp but no iat. The issue is fixed in 6.3.4. (Sources: OSV, NVD) Read full report → LOW 2.8 Node.js & npm 10 Oct msgpack5: Decoding negative int64 mutates input buffer (CVE-2026-107296) msgpack5 updates to 6.1.0 fix an issue where decoding a negative signed 64-bit integer can overwrite bytes in the caller-provided input buffer, causing silent corruption of retained or reused encoded data. (CVE-2026-107296, GHSA-qw35-55vc-rhgj) Read full report → LOW 3.4 Node.js & npm 10 Oct fast-jwt: clockTolerance = Infinity bypasses exp/nbf and persists in verifier cache (CVE-2026-107721) fast-jwt accepted Infinity for clockTolerance, letting exp and nbf checks always pass and allowing expired or not-yet-active JWTs to be accepted. Verifier cache entries created under that configuration can remain valid until eviction. The issue is fixed in 6.3.0. [CVE-2026-107721, GHSA-687g-22h4-j4w4] Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email