Node.js: security advisories, deprecations and releases

Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE

Technical analysis of a newly disclosed Brotli-related remote code execution vulnerability in Node.js and guidance on detecting the Node2Shell exploit.

CVE-2026-111497

Also covered by Wiz Blog , Aqua Security Blog , Datadog Security Labs

Node.js October 2026 Security Releases

Node.js publishes its scheduled security fixes for October 2026.

pnpm 11 reaches end of life on 2027-04-30

pnpm 11 reaches end of life on 2027-04-30, as listed by endoflife.date.

pnpm 10 reaches end of life on 2027-04-30

pnpm 10 reaches end of life on 2027-04-30, as listed by endoflife.date.

Node.js 22 reaches end of life on 2027-04-30

Node.js 22 reaches end of life on 2027-04-30, as listed by endoflife.date.

Retirement: Support for Node.js 22 ends on April 30, 2027

Microsoft Azure ends support for Node.js 22 on 30 April 2027. Function apps continue running but lose security patches and support.

Node.js 27.0.0-alpha.0.0.0 (Alpha)

First alpha release for the upcoming major Node.js 27 line, giving early access to the next major version.

Node.js 26.13.0 (LTS)

Node.js 26.13.0 is now available as a Long Term Support release.

Also covered by Node.js Blog

Node.js 24.22.1 (LTS)

Node.js 24.22.1 LTS is now available with updates and fixes.

Dependabot now supports npm 12, pnpm 11/12, and Bun 1.4

Dependabot now supports the latest package manager versions: npm 12, pnpm 11/12, and Bun 1.4 for GitHub.com and GitHub Enterprise Server 3.24.

Node.js 26.12.0 (Current)

Node.js 26.12.0 is now available as the latest Current release.

AWS Lambda Web Functions announced for standard HTTP web apps

AWS launches Lambda Web Functions, allowing standard Node.js HTTP servers like Express, Fastify, or Next.js to run on Lambda without event-handler rewrites. Supports multi-concurrent execution, active CPU billing, and automatic multi-region deployment.

Node.js 26.11.1 (Current)

Node.js 26.11.1 is now available as the latest Current release.

Node.js 26.11.0 (Current)

Node.js 26.11.0 is now the current release, delivering the latest updates and improvements to the Node.js runtime.

Node.js 26.10.0 (Current)

Node.js v26.10.0 is now available for the Current release line, introducing updates and fixes.

Node.js 22.23.3 (LTS)

Node.js 22.23.3 LTS release published.

Survey of package-manager sandboxing status across ecosystems

Homebrew, opam, Nix, Bazel and others differ in sandbox strength; many still rely on allow-lists or no isolation at all.