Blog: announce successful Node.js security release

[RafaelGSS]

Refs: https://github.com/nodejs-private/security-release/pull/74

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Jul 29, 2026 2:15pm

[cursor]

PR Summary

Low Risk
Documentation and site configuration only; no runtime or application logic changes.

Overview
Publishes the July 29, 2026 security release announcement on the vulnerability blog, replacing the earlier “releases coming” framing with full disclosure that fixes are available for 22.x, 24.x, and 26.x.

The post adds per-CVE write-ups (three High, several Medium, three Low), notes undici and llhttp dependency bumps, and links to v22.23.2, v24.18.1, and v26.5.1. Post metadata moves to July 29; prior postponement updates stay at the bottom.

The homepage banner in site.json is updated to say releases are available, with a new display window (2026-07-29 through 2026-08-05).

^{Reviewed by Cursor Bugbot for commit c8bbe7b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.13%. Comparing base (34f572b) to head (c8bbe7b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9045      +/-   ##
==========================================
+ Coverage   75.12%   75.13%   +0.01%     
==========================================
  Files         102      102              
  Lines        9109     9109              
  Branches      372      372              
==========================================
+ Hits         6843     6844       +1     
+ Misses       2262     2261       -1     
  Partials        4        4              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

Updates the nodejs.org site to announce that the July 2026 Node.js security releases are now available, including updating the homepage banner and publishing the corresponding vulnerability blog post.

Changes:

• Update the homepage security banner dates/message to reflect availability of the July 2026 security releases.
• Update the July 2026 vulnerability blog post front matter (date/title) and add the detailed CVE/dependency update content.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
apps/site/site.json	Updates the homepage banner to announce July 2026 security releases availability with a new active date window.
apps/site/pages/en/blog/vulnerability/july-2026-security-releases.md	Publishes the “security releases available” content and details for the July 2026 vulnerability post.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

📦 Build Size Comparison

Summary

Metric	Value
Old Total First Load JS	10.65 MB
New Total First Load JS	10.65 MB
Delta	-288.00 B (-0.00%)

Changes

🔄 Modified Routes (4)

Route	Old First Load JS	New First Load JS	Delta
/[locale]	2.54 MB	2.54 MB	📉 -72.00 B (-0.00%)
/[locale]/[...path]	2.54 MB	2.54 MB	📉 -72.00 B (-0.00%)
/[locale]/blog/[...path]	2.54 MB	2.54 MB	📉 -72.00 B (-0.00%)
/[locale]/download/archive/[version]	2.54 MB	2.54 MB	📉 -72.00 B (-0.00%)