KQL Search

Query Details

Identify Nodejs Installed Versions With Queries To Patch On Novembrer 11 HIGH Severity Nodejs Vulnerabilities

Query

DeviceTvmSoftwareInventory | where SoftwareName contains "node.js" or SoftwareName contains "nodejs" 
| extend MajorVersion = toint( extract(@"^v?(\d+)", 1, SoftwareVersion)) 
| extend SupportStatus = 
case( MajorVersion == 26, "Active LTS", MajorVersion in (22, 24), "Maintenance LTS",     MajorVersion == 27, "Alpha",     MajorVersion in (25, 23, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 0), "End of Life", "Unknown") 
| extend PatchReadiness = 
case( SupportStatus == "End of Life", "Migration required - No official security patches",     MajorVersion in (22, 24, 26), "Supported - Apply November 11 security update",     MajorVersion == 27, "Alpha - Review unsupported production deployment", "Review manually") 
| extend Priority = case( SupportStatus == "End of Life", 1, MajorVersion == 27, 2,     MajorVersion in (22, 24, 26), 3, 4) 
| project DeviceName, SoftwareVendor, SoftwareName, SoftwareVersion, MajorVersion, SupportStatus, PatchReadiness, Priority

About this query

Author: Sergio Albea (05/11/2026)

Identify/Upgrade Node.js installed Versions with queries to patch on Novembrer 11 HIGH-Severity Node.js Vulnerabilities

Node.js has announced upcoming security updates addressing multiple vulnerabilities, including high-severity issues. Organizations should start identifying installed Node.js versions across their environments, especially outdated or End-of-Life (EOL) releases that may no longer receive security patches. I created the following Query to quickly identify devices running Node.js, review their installed versions, and prioritize those requiring attention before the security updates become available.

Node.js post : https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Explanation

This query is designed to help organizations identify and prioritize devices running Node.js in preparation for upcoming security updates. Here's a simplified breakdown of what the query does:

  1. Filter Devices with Node.js: It searches through a software inventory to find devices that have Node.js installed. It looks for software names containing "node.js" or "nodejs".

  2. Extract Major Version: It extracts the major version number from the installed Node.js version on each device.

  3. Determine Support Status: Based on the major version, it categorizes the Node.js installation into different support statuses:

    • "Active LTS" for version 26
    • "Maintenance LTS" for versions 22 and 24
    • "Alpha" for version 27
    • "End of Life" for versions 25, 23, 21, and older versions down to 0
    • "Unknown" for any other versions

  4. Assess Patch Readiness: It evaluates what action is needed based on the support status:

    • "Migration required - No official security patches" for "End of Life" versions
    • "Supported - Apply November 11 security update" for versions 22, 24, and 26
    • "Alpha - Review unsupported production deployment" for version 27
    • "Review manually" for any other cases

  5. Set Priority: It assigns a priority level for addressing the Node.js installations:

    • Highest priority (1) for "End of Life" versions
    • Next priority (2) for "Alpha" version 27
    • Lower priority (3) for supported versions 22, 24, and 26
    • Lowest priority (4) for any other cases

  6. Output Relevant Information: Finally, it outputs a list of devices with relevant details such as device name, software vendor, software name, software version, major version, support status, patch readiness, and priority level.

This query helps organizations quickly identify which devices need immediate attention to ensure they are secure against upcoming vulnerabilities in Node.js.