Yesterday's placeholder is now a real changelog. The Node.js security releases — delayed a day by infrastructure trouble — landed as v26.5.1, v24.18.1, and v22.23.2, and the withheld CVE details are public. Eleven CVEs in total, three rated High: an HTTP/2 flaw where retained headers slip past the maxSessionMemory limit and exhaust memory (CVE-2026-56846), a re-entrant HTTP/2 send that triggers a heap use-after-free (CVE-2026-56848), and a Permission Model path-matching bug that over-grants filesystem access across radix-tree boundaries (CVE-2026-58043). The rest are mediums and lows across the HTTPS Agent, node:sqlite, dns.resolveAny(), and node:zlib, plus bundled undici and llhttp bumps. If you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox, treat this as the upgrade to do today — the two HTTP/2 issues are the ones that bite in production.