--- url: "https://www.xcademia.com/news/openjs-foundation-launches-security-stewardship-program-to-fund-node-js-vulnerability-work" title: OpenJS Foundation Launches Security Stewardship Program to Fund Node.js Vulnerability Work description: "OpenJS launches a Security Stewardship Program to fund Node.js vulnerability research, CVE coordination and maintainer security work." publishedAt: "2026-09-26T11:00:37.828+00:00" updatedAt: "2026-09-26T12:14:58.093336+00:00" type: news category: cybersecurity source_name: OpenJS Foundation source_url: "https://openjsf.org/blog/openjs-foundation-launches-the-security-stewardshi" tags: - "#OpenJS" - "#NodeJS" - "#JavaScriptSecurity" - "#OpenSourceSecurity" - "#Cybersecurity" - "#BugBounty" - "#CVE" - "#SoftwareSupplyChain" --- # OpenJS Foundation Launches Security Stewardship Program to Fund Node.js Vulnerability Work > The OpenJS Foundation has launched a Security Stewardship Program that funds vulnerability research, CVE coordination and maintainer support, with Node.js as its initial focus. Source: **OpenJS Foundation** · 26 September 2026 **T**he OpenJS Foundation has launched a new **Security Stewardship Program (SSP)** designed to provide structured funding for security research, vulnerability triage, CVE coordination and maintainer patching across the JavaScript ecosystem. Announced on September 25, 2026, the programme initially focuses on **Node.js**, with the broader goal of supporting security work across OpenJS projects. The initiative is backed at launch by **Socket and Aikido**, which are participating as inaugural partners. The programme comes after Node.js discontinued its own security bug bounty programme, according to the OpenJS Foundation. The new initiative is intended to address funding for both the people who discover vulnerabilities and the maintainers responsible for fixing them and producing security releases. ## A funding model connecting researchers and maintainers A central feature of the Security Stewardship Program is its pooled funding model. The OpenJS Foundation says contributions are divided equally between: - Security researcher bug bounties - Direct financial support for maintainers handling patching and release work The organisation says the model is designed to support both sides of the vulnerability lifecycle. Funding researchers can encourage vulnerability discovery, while maintainer funding supports the work required to triage, fix and release patches. The programme also includes structured vulnerability triage and CVE coordination. For projects under the OpenJS umbrella, the stated aim is to provide a clearer process from an initial vulnerability report through coordination, disclosure and remediation. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790420354997-info1--95-.webp) ## How organisations can participate The programme has a defined participation requirement. Organisations participating in the Security Stewardship Program must hold **OpenJS Silver membership** and contribute at least **$100,000 annually**. The OpenJS Foundation says contributions are pooled, with the 50/50 allocation between bug bounties and maintainer support applied across partner contributions. This creates a model in which participating organisations contribute directly to a shared security fund rather than funding isolated security activities independently. For companies that rely heavily on Node.js and the wider JavaScript ecosystem, the programme provides a formal route for supporting vulnerability research and maintenance work through the OpenJS Foundation. ## Socket and Aikido join as inaugural partners The Security Stewardship Program launches with **Socket and Aikido** as its inaugural partners. Socket is an OpenJS Silver member. According to the OpenJS Foundation, its contribution includes technical expertise around dependency analysis and malicious package detection. The foundation also says Socket's contribution model helped inform the programme's flexible contribution structure. Aikido joined the OpenJS ecosystem as a new OpenJS Silver member through its participation in the programme. The company is contributing to the initiative alongside Socket. The Node.js Technical Steering Committee also provided input and support during the programme's design, while partner sponsor agreements with both inaugural organisations have been finalised. ## Why maintainer funding matters Open source security often involves more than identifying a vulnerability. Once a vulnerability is reported, maintainers may need to verify the issue, assess its impact, coordinate disclosure, prepare a patch, test the fix and publish a security release. The OpenJS Foundation's announcement specifically connects these activities with the need for dedicated resources. Its stated objective is to provide financial support for maintainers alongside incentives for researchers. This distinction is important for projects such as Node.js, where security work involves both external vulnerability discovery and internal engineering and release processes. The programme therefore treats vulnerability discovery and remediation as connected parts of the same security lifecycle. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790420379479-info2--97-.webp) ## The programme's Node.js focus Node.js is the first target for the Security Stewardship Program. The OpenJS Foundation says the initiative is intended to address a funding gap following the discontinuation of Node.js's own security bug bounty programme. The foundation's initial approach is therefore focused on supporting security work around the runtime while establishing a structure that can support the wider JavaScript ecosystem. The announcement does not provide a detailed timetable for expanding the programme beyond its initial Node.js focus. **Additional details were not disclosed in the announcement.** ## Recognition for participating organisations Participation also includes recognition from the OpenJS Foundation. SSP partners are recognised on Node.js and OpenJS security pages and can be eligible for co-marketing through OpenJS blog posts, announcements and case studies. The programme therefore combines financial participation with public recognition of organisations supporting the security infrastructure around OpenJS projects. ## Why the initiative is being launched now The OpenJS Foundation points to the scale of the JavaScript ecosystem and the limited number of maintainers performing critical security work as reasons for creating a dedicated funding structure. The foundation's announcement frames the SSP as a longer-term funding mechanism connecting industry contributions with researchers and maintainers. It also acknowledges that the programme does not address every challenge associated with open source security. Instead, the stated objective is to establish a durable funding structure for specific security activities. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790420402219-info3--95-.webp) ## What the Security Stewardship Program could mean for the JavaScript ecosystem The announcement highlights a broader industry shift toward treating open source security maintenance as an activity that requires sustained resources rather than relying primarily on volunteer effort. For enterprises, the programme provides a formal mechanism for contributing to the security work around a technology they may depend on. The 50/50 funding structure also makes the relationship between vulnerability discovery and remediation explicit. For researchers, the programme introduces funding for bug bounty activity. For maintainers, it creates a dedicated source of financial support for vulnerability patching and security release work. The immediate scope remains Node.js, so the longer-term impact across other OpenJS projects will depend on how the programme develops. ## What has been announced so far The key elements of the programme are: **Area** **Announced detail** Programme Security Stewardship Program Organisation OpenJS Foundation Initial focus Node.js Main activities Security research, vulnerability triage, CVE coordination and maintainer support Funding allocation 50% bug bounties, 50% maintainer support Participation OpenJS Silver membership Minimum annual contribution $100,000 Inaugural partners Socket and Aikido Node.js Technical Steering Committee Provided input and support during programme design Partner recognition Node.js and OpenJS security pages plus potential OpenJS co-marketing All details in the table above come from the OpenJS Foundation's September 25, 2026 announcement. ## What remains unclear The announcement establishes the programme's funding structure and initial Node.js focus, but several operational details are not specified. These include the detailed process for selecting individual bug bounty cases, how funding decisions will be prioritised, the exact expansion timetable for other OpenJS projects and any published metrics for measuring programme outcomes. **The company did not provide specific information about this area.** For now, the clearest takeaway is that the OpenJS Foundation has established a formal funding mechanism connecting security researchers, maintainers and industry sponsors around Node.js security work. ## Conclusion The OpenJS Foundation's Security Stewardship Program introduces a structured funding model for vulnerability research and open source maintenance, beginning with Node.js. By dividing partner contributions between researcher bug bounties and maintainer support, the programme is designed to address two connected parts of the vulnerability lifecycle: finding security issues and getting them fixed and released. With Socket and Aikido as inaugural partners and the Node.js Technical Steering Committee involved in the programme's design, the initiative now moves from announcement to implementation. Its longer-term reach across the JavaScript ecosystem will depend on future participation and programme development. ## Original source https://openjsf.org/blog/openjs-foundation-launches-the-security-stewardshi ## Tags `#OpenJS` · `#NodeJS` · `#JavaScriptSecurity` · `#OpenSourceSecurity` · `#Cybersecurity` · `#BugBounty` · `#CVE` · `#SoftwareSupplyChain` --- ## About this content This Markdown news article is the citation-grade twin of [OpenJS Foundation Launches Security Stewardship Program to Fund Node.js Vulnerability Work](https://www.xcademia.com/news/openjs-foundation-launches-security-stewardship-program-to-fund-node-js-vulnerability-work). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/openjs-foundation-launches-security-stewardship-program-to-fund-node-js-vulnerability-work - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt