nodejs-june-2026-security-releases: Thursday, June 18, 2026 Security Releases
Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities:
llhttp (9.4.2) on all release lines
nghttp2 (1.69.0) on all release lines
openssl (3.5.7) on all release lines
undici (8.5.0) on 26.3.1
undici (7.28.0) on 24.17.0
undici (6.27.0) on 22.23.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
llhttpto a version that resolves this vulnerability.Fixed in 9.4.2 - Upgrade
Upgrade
nghttp2to a version that resolves this vulnerability.Fixed in 1.69.0 - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 3.5.7 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.27.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Node.js release lines have security updates available?
Updates are available for the 26.x, 24.x, and 22.x Node.js release lines.
Which dependency updates apply to every supported release line?
All listed release lines include llhttp 9.4.2, nghttp2 1.69.0, and OpenSSL 3.5.7.
Which undici version is included for each updated Node.js line?
Node.js 26.3.1 includes undici 8.5.0, Node.js 24.17.0 includes undici 7.28.0, and Node.js 22.23.0 includes undici 6.27.0.