Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
26.9.0
RELEASE PATCH Node.js & npm Node.js · released September 16, 2026 · covered September 16, 2026

Node.js 26.9.0 Released

Node.js 26.9.0 has been published on the official release channel. No detailed changelog notes were provided with this release announcement.

Node.js 26.x line Version 26.9.0 Official release blog
AI summary

Node.js 26.9.0 has been published as part of the Node.js 26.x release line. This announcement comes from the official Node.js release blog, though no detailed changelog or release notes text was included in the fact package provided for this coverage.

What we know

The release is listed as Node.js version 26.9.0, published via the official Node.js release channel on September 16, 2026. No specific bug fixes, features, or security notes were included in the source material for this release, so we cannot report on the exact contents of this update beyond its existence and version number.

How to update

As with any Node.js release, you can check your currently installed version with `node -v` and update using your preferred version manager, such as nvm (`nvm install 26.9.0`), fnm, or by downloading the installer directly from the official Node.js website. If you manage Node.js versions through a system package manager, follow its standard upgrade procedure. Before upgrading production systems, it's good practice to consult the full release notes on the official Node.js blog to review the complete list of changes and confirm compatibility with your application.

Staying informed

Because this fact package did not include detailed release notes, we recommend checking the linked official Node.js blog post directly for the authoritative list of commits, fixes, and any notable changes included in 26.9.0 before deciding on upgrade priority.

Synthesized by AI from 1 source · updated 1 hour ago
Sources · merged by AI 1 total
notes ↗
LOW 2.5 Node.js & npm 10 Oct fast-jwt: Verifier cache accepts expired JWTs (CVE-2026-107719) fast-jwt's createVerifier cache can accept a previously valid signed JWT after its exp time when caching is enabled and the token has exp but no iat. The issue is fixed in 6.3.4. (Sources: OSV, NVD) Read full report → LOW 2.8 Node.js & npm 10 Oct msgpack5: Decoding negative int64 mutates input buffer (CVE-2026-107296) msgpack5 updates to 6.1.0 fix an issue where decoding a negative signed 64-bit integer can overwrite bytes in the caller-provided input buffer, causing silent corruption of retained or reused encoded data. (CVE-2026-107296, GHSA-qw35-55vc-rhgj) Read full report → LOW 3.4 Node.js & npm 10 Oct fast-jwt: clockTolerance = Infinity bypasses exp/nbf and persists in verifier cache (CVE-2026-107721) fast-jwt accepted Infinity for clockTolerance, letting exp and nbf checks always pass and allowing expired or not-yet-active JWTs to be accepted. Verifier cache entries created under that configuration can remain valid until eviction. The issue is fixed in 6.3.0. [CVE-2026-107721, GHSA-687g-22h4-j4w4] Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email