Plans to update V8 in Node.js 26 to 14.8 (CVE fixes for V8 14.7/14.8)

[guru2018]

Node.js 26.12.1 ships V8 14.6.202.34. Vulnerability scanners match on the V8 version and report 9 published V8 CVEs as open for it. All 9 are fixed in V8 14.7 or 14.8, and V8 14.8.178.28 contains all of them.

Are there plan to address these CVEs in Node.js 26 ?

CVEs fixed in V8 14.7:

• CVE-2026-5863
• CVE-2026-5873
• CVE-2026-6301 (Turbofan)
• CVE-2026-6307 (Turbofan)

CVEs fixed in V8 14.8 (14.8.178.28):

• CVE-2026-9896
• CVE-2026-9938
• CVE-2026-9968
• CVE-2026-9973
• CVE-2026-10022

Most of these are type confusions, out-of-bounds reads or writes, and integer overflows in V8 and Turbofan.