Following the Node.js November 11 Security Release Live: From Before Publication to Exploitation (Updated as It Develops)

Latest status (November 11, 1:00 p.m. New York time, ET): the security release has been published. The fixed versions are 22.23.5, 24.22.3 and 26.13.1, and it fixes 16 vulnerabilities. As far as I can confirm, there are no reports of exploitation yet.

The Node.js project published security releases for the 26.x, 24.x and 22.x lines on Wednesday, November 11, 2026. All times are New York time (Eastern Standard Time), 14 hours behind Tokyo.

November 11, 1:00 p.m. ET　Fixed versions published

The security release was published at about 11:44 a.m. New York time on November 11 (from the timestamps of the GitHub releases). The fixed versions are 26.13.1 for the 26.x line, 24.22.3 for 24.x and 22.23.5 for 22.x. According to the Node.js blog, it fixes 16 vulnerabilities: 7 High, 6 Medium and 3 Low. The 24.x and 26.x lines are affected by all 16, and 22.x by 11 of them (4 High, 4 Medium and 3 Low). The release also updates the bundled dependencies llhttp, undici and sqlite.

The HTTP/2 flaws stand out by count. On a server that accepts HTTP/2, an unauthenticated peer can crash the process (CVE-2026-123863, CVE-2026-123875 and others), make it hold on to memory and file descriptors indefinitely (CVE-2026-123865, CVE-2026-123868), get it to send freed memory back to the peer (CVE-2026-123866), or corrupt memory through a use-after-free (CVE-2026-123874). If you expose an HTTP/2 server directly, start here.

The one that worries me most is the HTTPS flaw (CVE-2026-123864). According to the Node.js blog, an unauthenticated client may be able to read memory belonging to other connections, which can include TLS private keys and other users’ requests. There are conditions. The server needs a handler that calls res.flushHeaders() before the request body has ended and later calls res.end() with a non-empty chunk, and it needs an ordinary route that echoes or stores a request body. Cleartext node:http is not affected. All of 22.x, 24.x and 26.x are in scope.

There are also three certificate-authentication bypasses. One lets a client change the servername during TLS 1.2 renegotiation and slip past client-certificate rules set per host (CVE-2026-123872, High). Another makes a per-host client CA, set without a server certificate, silently fall back to the default CA (CVE-2026-123867, Medium). The third lets https.Agent reuse a TLS session across requests with different CA settings and pass validation (CVE-2026-123877, Medium). All three need servers that vary their authentication per host, or clients that mix CA policies, so an ordinary web server will not meet the conditions. There is also a flaw that lets a remote attacker crash a TLS server that uses hooks such as SNICallback (CVE-2026-126051, High).

On exploitation, neither the Node.js blog nor the release notes say anything. I checked the CISA catalog of known exploited vulnerabilities (KEV) at about 12:58 p.m. New York time on November 11, and none of the 16 is listed (the data I could retrieve is dated November 10). A web search turned up no reports of exploitation or public exploit code either. The release is only about an hour old, so this means “no report yet”, not “safe”. The October Brotli flaw saw attack traffic observed five days after its release.

My own view is that priority depends on how your Node.js is exposed. If Node.js terminates HTTP/2 or HTTPS directly, update soon. If a reverse proxy sits in front so that HTTP/2 and TLS never reach Node.js, the exposure should be smaller, but you need to confirm that against your own setup. If you have not yet applied the October fixes (22.23.4, 24.22.1 and 26.12.1), moving to this release brings them in as well. End-of-life lines such as 20.x and 25.x get no fix, so move to a supported line. You can check your version with node -v, and the release is also on the GitHub releases page.

November 11, 10:20 a.m. ET　Before publication

On November 3, Node.js posted an advance notice for the November 11 security releases. It covers the 26.x, 24.x and 22.x lines, and the highest severity issue in each line is High. Publication is expected “on, or shortly after” November 11. The notice does not say how many issues there are, which CVEs they are, what they affect, or which versions fix them. It says nothing about exploitation either. The notice has not been updated since November 3 (I checked at about 10:20 a.m. New York time on November 11).

The notice makes one more point. End-of-life versions are always treated as affected by a security release, and they get no fix. If you run 20.x or 25.x, you need to move to a supported line whatever this release contains.

The previous release, on October 21, fixed ten issues: four High, three Medium and three Low (Node.js blog). We do not know the count this time. The highest severity being High matches the last release.

There is one thing you can do ahead of time. If you have not yet applied the October fixes (22.23.4, 24.22.1 and 26.12.1), I recommend moving to at least those versions now rather than waiting for tomorrow’s build. One of the October fixes, the Brotli flaw (CVE-2026-111497), is already being exploited. CISA added it to its Known Exploited Vulnerabilities catalog (KEV) on October 27, with a federal remediation deadline of November 10 (I checked the CISA data directly). My view is that the risk of leaving an actively exploited flaw unpatched for another day outweighs the effort of updating twice.

October background: the Brotli flaw that is already exploited

On October 21, Node.js fixed ten vulnerabilities. The most serious is an out-of-bounds write in the decoder of Brotli, a data compression format (CVE-2026-111497, nicknamed Node2Shell). Feeding the decoder specially crafted data can lead to code execution.

ELLIO reported observing attack traffic on October 26 (Help Net Security), and CISA added the flaw to KEV on October 27. Cloudflare also lists it as “Needs attention” in its Zero Wire briefing. The root cause is the Brotli library that Node.js bundles, so the impact reaches beyond Node.js, including .NET and Palo Alto’s PAN-OS.

Where to check is covered in our article on why the Brotli flaw is not just a Node.js problem, and all ten fixes and the update steps are in our technical summary of the ten Node.js vulnerabilities. For how to keep updating over time, see part four of our series, keeping software up to date.