Node.js has been doing security pre-announcements for years. This isn’t something they started a year or two ago. It’s a deliberate, responsible decision.
Publishing patches whenever they’re ready, without advance notice, ignores the schedules of all the developers who need to respond.
Also, I actually trust projects that are actively working on security these days more. It shows they’re improving their workflows and actively making their projects more secure.
Node.js @nodejsSecurity release pre-alert: We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities. The highest severity issue fixed in this release is HIGH.
32396.3K






