Node.js developers have released security updates to address multiple vulnerabilities (CVE-2026-21637, CVE-2026-21710, CVE-2026-21711, CVE-2026-21712, CVE-2026-21713, CVE-2026-21714, CVE-2026-21715, CVE-2026-21716, CVE-2026-21717). A remote attacker could exploit some of these vulnerabilities to trigger memory leak, security restriction bypass and denial of service condition on the targeted system. The vulnerabilities were fixed in Node.js 25.8.2 (Current), Node.js 20.20.2 (LTS), Node.js 22.22.2 (LTS), Node.js 24.14.1 (LTS).

Source: nodejs.org