nodejs-july-2026-security-releases: Wednesday, July 29, 2026 Security Releases

Published Jul 29, 2026

Updated

Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.

This security release includes the following dependency updates to address public vulnerabilities:

undici (8.9.0, 7.29.0, 6.28.0) on 26.x, 24.x, 22.x

llhttp (9.4.3) on 26.x, 24.x, 22.x

Affected Software

3 affected components

OpenJS Foundation Node.js=26.x, =24.x, =22.x

npm/undici=8.9.0, =7.29.0, =6.28.0

npm/llhttp=9.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade llhttp to a version that resolves this vulnerability.
Fixed in 9.4.3
Upgrade
Upgrade undici to a version that resolves this vulnerability.
Fixed in 8.9.0
Upgrade
Upgrade undici to a version that resolves this vulnerability.
Fixed in 7.29.0
Upgrade
Upgrade undici to a version that resolves this vulnerability.
Fixed in 6.28.0

Event History

Jul 29, 2026

Advisory Published

via Node.js·12:00 AM

Data Sourced

via Node.js·12:00 AM

Description

Child vulnerabilities

Contains the following vulnerabilities.

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2026-48934

Frequently Asked Questions

Which Node.js release lines received these dependency updates?

Updates are available for the 26.x, 24.x, and 22.x Node.js release lines.

Which bundled dependencies were updated?

Undici was updated to 8.9.0, 7.29.0, and 6.28.0 for the 26.x, 24.x, and 22.x lines respectively. llhttp was updated to 9.4.3 on all three release lines.