Impact Score: 5/10
Strapi v4.26.2 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: strapi · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Strapi v4.26.2. Source highlight: :warning: Note: This is the final Strapi 4 release :warning:
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (1)
- Added Node.js 22 support for Strapi v4.
🔧 Bug Fixes & Patches (2)
- Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization. See GHSA-rjg2-95x7-8qmx / CVE-2026-27886.
- Enforced unique admin email validation when updating the authenticated user profile.
📄 View Raw Release Notes (Original Developer Log)
## :warning: Note: This is the final Strapi 4 release :warning:
No further updates to Strapi 4 will be published, this release serves as the final version of Strapi 4 which is considered EOL (End-Of-Life) as of April 30th, 2026. All Strapi users should migrate to Strapi 5: https://docs.strapi.io/cms/migration/v4-to-v5/introduction-and-faq
Also please note, this does include Strapi Customers as well. Strapi Cloud will still continue to function with Strapi 4 but that may be subject change in the near future without warning.
## What's Changed
### Security
* Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization. See [GHSA-rjg2-95x7-8qmx](https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmx) / CVE-2026-27886.
* Upgraded `tar` to v7 to address security warnings.
* Applied v4 dependency security and maintenance updates.
### Fixes
* Enforced unique admin email validation when updating the authenticated user profile.
### Compatibility
* Added Node.js 22 support for Strapi v4.
**Full Changelog**: https://github.com/strapi/strapi/compare/v4.26.1...v4.26.2