Node.js 26.11.0 refreshes OpenSSL, certificates, and undici

Node.js 26.11.0 was published on 7 October 2026. The version number hides a bundle update. OpenSSL moves to 3.5.9. The root certificate set moves to NSS 3.129. The undici HTTP client moves to 8.11.2. npm moves to 11.20.0. Timezone data moves to 2026e, after an earlier bump to 2026d in the same release. zlib and V8 are updated as well.

The release notes reviewed for this story do not name CVEs. That does not mean OpenSSL 3.5.9 or NSS 3.129 were empty. OpenSSL’s own 29 September advisory is a security release, and a Node upgrade is how many servers will actually receive it. Check those upstream notes before you call the Node release “just maintenance.”

Two operational details sit beside the library bumps. Alpine Linux is promoted to tier 2 support. Teams who build Node images on Alpine should read what tier 2 means in Node’s own support docs before they assume the platform is covered the same way as a tier 1 OS. And the interesting failures from this kind of release are not crashes. They are TLS handshakes and HTTP behavior: a certificate that used to be trusted, a client that used to accept a response, a timezone that shifts a log timestamp.

The questions worth answering before you roll it are boring and specific. Which line is production on: Current, long-term support, or maintenance? 26.11 is a Current-line update, so an LTS fleet does not take it just because the number is newer. Who runs a test against real traffic when encryption, certificates, or the HTTP client change? A green unit suite will not show a partner API that rejects the new trust store.

If you are on Node 26, schedule 26.11 because of OpenSSL 3.5.9, and read the certificate diff before you ship it to every region on the same day.