Tip: which Node.js services to upgrade first after the Nov 11 release

operational guidance based on the Node.js Nov 11, 2026 security release notes2026-11-11 7:41 PM ET

First: node:https servers with routes that echo or store request bodies, especially if handlers call res.flushHeaders() early (CVE-2026-123864 heap leak; cleartext node:http isn't affected). Rotate the TLS key on any such server you can't rule out.
Next: anything using http2.createSecureServer or http2.createServer, and especially stream.respondWithFile() / respondWithFD() (CVE-2026-123874, -123875).
Auth checks: servers that apply different client-certificate rules per hostname with server.addContext() (CVE-2026-123872, -123867), and clients that mix default and custom ca settings on one https.Agent (CVE-2026-123877).
Find versions fast: node -v on hosts; in containers, check base image tags (node:22, node:24, node:26) and rebuild; Electron and bundled runtimes need their own vendor updates.
Logs: grep for ERR_PROXY_INVALID_CONFIG; if proxy URLs with credentials appear, rotate those credentials (CVE-2026-123871).