Monday, July 27, 2026 Security Releases

The Node.js Project will ship new builds on the 26.x, 24.x, and 22.x release lines on or shortly after Monday, July 27, 2026. The notice, posted on the Node.js Blog under Monday, July 27, 2026 Security Releases, states that the highest severity issue fixed in this drop is HIGH. That same HIGH ceiling applies separately to each of the three lines: 26.x, 24.x, and 22.x.

These are coordinated security releases across the active 26.x, 24.x, and 22.x lines rather than a single-line patch. Timing is fixed to on or shortly after Monday, July 27, 2026, with further contact and update channels left for follow-on project notices. Commercial support for versions past the Maintenance LTS phase is offered through OpenJS Ecosystem Sustainability Program partners; End-of-Life versions are called out as always affected when a security release lands, with the project pointing operators at the Release Schedule for current supported lines.

For engineers and builders, a HIGH-severity fix across 26.x, 24.x, and 22.x means production runtimes on any of those lines need a deliberate upgrade path once the builds appear. Teams still on End-of-Life Node.js cannot treat “we are not on the listed lines” as safety; the project states EOL versions are always affected when security releases occur. Pinning, image rebuilds, and CI base-image bumps should be planned around the July 27, 2026 window so rollouts are not blocked on the day packages land.

In the broader runtime market, Node.js remains a default server and tooling runtime; a same-day multi-line HIGH release is the usual OpenJS/Node model for getting fixes onto Current and LTS tracks together. Operators who have already left Maintenance LTS can use OpenJS Ecosystem Sustainability Program partners for commercial support instead of staying on unmaintained public builds. Competitors and adjacent stacks do not change the operational fact: if you run Node 26.x, 24.x, or 22.x, this release is in your patch queue.

Practical takeaway: treat Monday, July 27, 2026 (or shortly after) as the availability date for 26.x, 24.x, and 22.x security builds; verify your fleet against the Release Schedule; move anything still on End-of-Life onto a supported line or commercial support; and watch the Node.js Blog and project contact channels for the exact build numbers and any follow-up once the HIGH-severity packages are published.