JavaScript: security advisories, deprecations and releases

Upcoming Next.js November Security Release

Next.js will issue a security release on November 3, 2026.

Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE

Technical analysis of a newly disclosed Brotli-related remote code execution vulnerability in Node.js and guidance on detecting the Node2Shell exploit.

CVE-2026-111497

Also covered by Wiz Blog , Aqua Security Blog , Datadog Security Labs

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

Next.js Security Update for Upstream Vulnerabilities

Next.js released an out-of-band security update on October 14, 2026, addressing upstream vulnerabilities.

Node.js October 2026 Security Releases

Node.js publishes its scheduled security fixes for October 2026.

Upcoming Next.js Security Update for Upstream Vulnerabilities

Next.js will release an out-of-band security patch on October 14, 2026, fixing two Critical and one High severity vulnerabilities in upstream dependencies.

Unvalidated npm trusted publishing configurations now expire

Unvalidated npm trusted publishing setups now expire after 48 hours and lose publishing rights, reducing risk from repository ownership changes.

Upcoming Next.js Security Update for a Critical Upstream Issue

Next.js 16.3.6 and 15.5.26 will receive a critical out-of-band security patch on September 22, 2026.

Next.js Security Update for a Critical Upstream Issue

Out-of-band security update released on September 22, 2026 for a critical upstream issue.

Upcoming Next.js September Security Release

Next.js will issue a scheduled security release on September 30, 2026.

September 2026 Security Release

Next.js September 2026 security release is now available.

Next.js 15 reaches end of life on 2027-01-31

Next.js 15 reaches end of life on 2027-01-31, as listed by endoflife.date.

pnpm 11 reaches end of life on 2027-04-30

pnpm 11 reaches end of life on 2027-04-30, as listed by endoflife.date.

pnpm 10 reaches end of life on 2027-04-30

pnpm 10 reaches end of life on 2027-04-30, as listed by endoflife.date.

Node.js 22 reaches end of life on 2027-04-30

Node.js 22 reaches end of life on 2027-04-30, as listed by endoflife.date.

Next.js 15 reaches end of life on 2027-01-31

Next.js 15 reaches end of life on 2027-01-31, as listed by endoflife.date.

Electron 45 reaches end of life on 2027-04-27

Electron 45 reaches end of life on 2027-04-27, as listed by endoflife.date.

Next.js 15 has reached end of life

Next.js 15 reached end of life on 2026-10-21, as listed by endoflife.date.

Electron 42 has reached end of life

Electron 42 reached end of life on 2026-10-20, as listed by endoflife.date.

Electron 43 reaches end of life on 2027-01-05

Electron 43 reaches end of life on 2027-01-05, as listed by endoflife.date.

Ember 7.2 has reached end of life

Ember 7.2 reached end of life on 2026-10-05, as listed by endoflife.date.

Retirement: Support for Node.js 22 ends on April 30, 2027

Microsoft Azure ends support for Node.js 22 on 30 April 2027. Function apps continue running but lose security patches and support.

Next.js 15 reaches end of life on 2026-10-21

Next.js 15 reaches end of life on 2026-10-21, as listed by endoflife.date.

Electron 42 reaches end of life on 2026-10-20

Electron 42 reaches end of life on 2026-10-20, as listed by endoflife.date.

Electron 44 reaches end of life on 2027-03-02

Electron 44 reaches end of life on 2027-03-02, as listed by endoflife.date.

Electron 43 reaches end of life on 2027-01-05

Electron 43 reaches end of life on 2027-01-05, as listed by endoflife.date.

Ember 6.8 reaches end of life on 2026-12-08

Ember 6.8 reaches end of life on 2026-12-08, as listed by endoflife.date.

Node.js 27.0.0-alpha.0.0.0 (Alpha)

First alpha release for the upcoming major Node.js 27 line, giving early access to the next major version.

Node.js 26.13.0 (LTS)

Node.js 26.13.0 is now available as a Long Term Support release.

Also covered by Node.js Blog

Prioritize Dependabot alerts with reachability analysis

Reachability analysis for Dependabot now in public preview for JavaScript/TypeScript. It identifies call paths from your code to vulnerable functions, helping prioritize alerts.

Electron 45 released

Electron 45 was released on 2026-10-20.

Node.js 24.22.1 (LTS)

Node.js 24.22.1 LTS is now available with updates and fixes.

Dependabot now supports npm 12, pnpm 11/12, and Bun 1.4

Dependabot now supports the latest package manager versions: npm 12, pnpm 11/12, and Bun 1.4 for GitHub.com and GitHub Enterprise Server 3.24.

Improving navigation experience in v0 with Next.js 16.4

Describes use of Partial Prefetching and a coding agent to improve navigation across v0 with Next.js 16.4.

Node.js 26.12.0 (Current)

Node.js 26.12.0 is now available as the latest Current release.

AWS Lambda Web Functions announced for standard HTTP web apps

AWS launches Lambda Web Functions, allowing standard Node.js HTTP servers like Express, Fastify, or Next.js to run on Lambda without event-handler rewrites. Supports multi-concurrent execution, active CPU billing, and automatic multi-region deployment.

Node.js 26.11.1 (Current)

Node.js 26.11.1 is now available as the latest Current release.

Node.js 26.11.0 (Current)

Node.js 26.11.0 is now the current release, delivering the latest updates and improvements to the Node.js runtime.

Next.js 16.4

Next.js 16.4 adds lazy compilation, smaller Turbopack output, React 19.3 support, Cache Components improvements, and new developer tooling.

npm staged publishing now supports creating new packages

npm stage publish can now create new public or private scoped packages and public unscoped packages from automated workflows without a manual first publish.

Ember 7.3 released

Ember 7.3 was released on 2026-10-05.

Node.js 26.10.0 (Current)

Node.js v26.10.0 is now available for the Current release line, introducing updates and fixes.

Node.js 22.23.3 (LTS)

Node.js 22.23.3 LTS release published.

Ship less JavaScript in Next.js with your AI agent

Next.js introduces a next-bundle-optimizer agent skill and new Bundle Analyzer tools to reduce JavaScript bundle sizes.

Survey of package-manager sandboxing status across ecosystems

Homebrew, opam, Nix, Bazel and others differ in sandbox strength; many still rely on allow-lists or no isolation at all.