Upcoming Node.js Security Releases on November 11, 2026: Updates for CloudLinux

CloudLinux delivers Node.js to hosting accounts as alt-nodejs packages, the versions Node.js Selector offers each account. A fix published on nodejs.org reaches your servers only when we rebuild those packages and you install them.

What CloudLinux will release

We start building as soon as Node.js publishes the fixes, and plan to release alt-nodejs 22, 24, and 26 later the same day.

Node.js fixes only 22.x, 24.x, and 26.x, and says end-of-life versions are always affected when a security release occurs. Older, end-of-life alt-nodejs versions, such as 18 and 20, will also receive backported fixes. The status page will say which, and when.

On cPanel servers running CloudLinux 8, ea-nodejs22 also comes from the CloudLinux repositories. We rebuild it from cPanel’s package, so its fix arrives once cPanel releases an updated version.

The native nodejs packages that CloudLinux ships as part of the operating system are a separate set. For those we follow Red Hat and AlmaLinux, so they are fixed when AlmaLinux ships its update.

Once Node.js has published its releases, this post becomes the full advisory: what the releases fix, the fixed package versions, and how to update and verify.

What to do before November 11

Subscribe to the CloudLinux status page. Package releases will be posted there.

List the alt-nodejs versions on each server. Each account picks its Node.js version in Node.js Selector, so one server can run several versions at once, end-of-life ones included:

rpm -qa 'alt-nodejs*'

Plan time to restart applications. A running Node.js application keeps the old binary until it restarts. After updating, restart each application from Node.js Selector or with:

cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>

Need help? Contact our support team

References

• Node.js: November 2026 security releases
• CloudLinux status page: Node.js security releases, November 11, 2026