Node.js July 2026 Security Release: 11 CVEs, Node 18 and 20 EOL

On July 29, 2026, the Node.js project shipped security releases for the 22.x, 24.x, and 26.x lines after two consecutive one-day delays, fixing eleven CVEs: three High, five Medium, and three Low severity. The Highs land on two of the most sensitive surfaces in the runtime. Two sit in HTTP/2 handling, including a heap-use-after-free triggered by re-entrant session sends (CVE-2026-56848), and one lets code running under the --permission sandbox read and write outside its filesystem allowlist (CVE-2026-58043). Node.js 18 and Node.js 20 received nothing upstream: both lines are past end of life, and as the advisory itself notes, "End-of-Life versions are always affected when a security release occurs."

Running Node 18 or Node 20 past end of life? See Node.js NES.

‍

What shipped upstream on July 29

The upstream fixes landed in Node.js v22.23.2, v24.18.1, and v26.5.1. The release was originally slated for earlier in the week and slipped twice: once for additional testing and validation, then a second time for infrastructure issues, per the updates on the advisory page. Alongside the eleven CVE fixes, the release bumped two bundled dependencies across all three lines: undici (8.9.0, 7.29.0, and 6.28.0 per line) and llhttp 9.4.3.

Two patterns in this batch are worth internalizing.

First, HTTP/2 keeps producing High-severity bugs. Two of the three Highs sit in the same subsystem: CVE-2026-56846 lets retained header blocks evade the maxSessionMemory limit, the exact control built to stop remote memory exhaustion, and CVE-2026-56848 allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is still executing, producing a heap-use-after-free. Teams that patched the June HTTP/2 fixes and considered that surface handled are exposed on it again a month later.

Second, the Permission Model needed fixes again. Three of the eleven CVEs target --permission enforcement: the High-severity path-matching over-grant (CVE-2026-58043), plus two Lows where trace_events (CVE-2026-56847) and process.report (CVE-2026-58039) write files outside the --allow-fs-write allowlist. Permission Model bypasses have now appeared in every Node.js security release of 2026. If the sandbox is part of your threat model, it needs to be treated as a defense-in-depth layer, not a boundary.

There is also an incomplete-fix follow-up in the batch: CVE-2026-58040 revisits June's HTTPS Agent session-reuse hostname verification flaw (CVE-2026-48934), meaning the June patch did not fully close the hole.

‍

Node 18 and Node 20 are EOL. The download numbers have not noticed.

Node.js 18 reached end of life on April 30, 2025. Node.js 20 reached end of life on April 30, 2026. Neither line receives upstream security fixes.

Per the Node.js download statistics project, July 2026 version-attributed downloads tell the same story the June numbers did. Node 20 pulled roughly 103.8 million downloads, still the third-most-downloaded release line on the planet, out-downloading the current Node 26 line better than two to one. Node 18, fifteen months past end of life, added another 32.7 million.

Combined, the two EOL lines were downloaded more than 136 million times in July. That is roughly 4.4 million downloads per day, and about one in six version-attributed Node.js downloads. Three months after Node 20's EOL date, the curve has barely moved.

‍

The full July CVE list

The table below lists every CVE in the July 29 advisory with its severity as classified by the Node.js project, the affected component, and the active release lines the advisory names.

‍

What this list means for Node 18 and Node 20

The advisory's blanket statement applies: EOL versions are always affected when a security release occurs. Two structural carve-outs narrow the exposure. The three Permission Model CVEs do not apply to Node 18, because the Permission Model was introduced in Node 20. And the node:sqlite flaw does not apply to either EOL line, since the module did not exist before Node 22. Everything else, including both HTTP/2 Highs and the full TLS and HTTP parser set, lands on code paths the 18.x and 20.x lines share with their supported successors.

HeroDevs is evaluating the July batch against the Node 18 and Node 20 NES lines now, following the same process as every upstream security release. For reference, the June remediations shipped as Node.js NES v18.20.18 and Node.js NES v20.20.3 on June 25, one week after the upstream disclosure, with per-CVE release notes and machine-readable VEX statements. The July applicability determinations will publish the same way.

‍

How to get patched

If you are on a supported line, upgrade to v22.23.2, v24.18.1, or v26.5.1 now. The undici and llhttp bumps ride along, which matters if you audit transitive HTTP internals.

If you are on Node 18 or Node 20, migration to a supported line is always the first recommendation. But migrations take quarters, and the July CVEs are live now. Node.js NES exists for exactly this gap: source-available, drop-in replacement builds of Node 18 and 20 that keep receiving security remediations after upstream support ends, so the migration can happen on your schedule instead of an attacker's.

‍

Why HeroDevs is the remediation path the Node.js project points to

This is not an aftermarket patch shop guessing at diffs. HeroDevs is an official partner of the Node.js project through the OpenJS Foundation, and was the inaugural partner in the OpenJS Ecosystem Sustainability Program. The July advisory page itself carries the project's standing note that commercial support for versions past Maintenance LTS is available through its Ecosystem Sustainability Program partners. Part of the value of that partnership flows back upstream: it funds ongoing Node.js development and security work on the versions everyone uses.

For the July batch specifically, that means Node 18 and Node 20 users get remediations built by engineers working alongside the project, published with per-CVE release notes and VEX statements your scanners can consume.

‍

Taking action

If you are on a supported line, take the upgrade this week; two High-severity HTTP/2 flaws on an internet-facing surface justify it on their own. If you are among the 136 million monthly downloads still on Node 18 or Node 20, you have two real options: accelerate the migration, or get patched where you stand with Node.js NES.

For the broader picture, see our coverage of the June 2026 Node.js security release and the March 2026 Node.js security release, our reference on Node.js end-of-life dates, and our guides to what EOL means in practice for Node 20 and Node 18. And if you want to talk through coverage for your specific stack, get in touch.