---
title: Tip: which Node.js services to upgrade first after the Nov 11 release | ctxsec
url: https://ctxsec.com/items/tip-nodejs-nov-2026-patch-order-https-body-echo-http2-respondwithfile-per-host-mtls
description: "Every supported Node.js line is affected, but the conditions in the release notes tell you where the worst bugs actually apply. Start with internet-facing HTTPS and HTTP/2 servers, then anything doing per-host mTLS."
status: "operational guidance based on the Node.js Nov 11, 2026 security release notes"
published: 2026-11-11
---

> Every supported Node.js line is affected, but the conditions in the release notes tell you where the worst bugs actually apply. Start with internet-facing HTTPS and HTTP/2 servers, then anything doing per-host mTLS.

[← Tips & Guides](/tips) · [markdown](/items/tip-nodejs-nov-2026-patch-order-https-body-echo-http2-respondwithfile-per-host-mtls.md)

operational guidance based on the Node.js Nov 11, 2026 security release notes

2026-11-11 7:41 PM ET

### Tip: which Node.js services to upgrade first after the Nov 11 release

- **First:** node:https servers with routes that echo or store request bodies, especially if handlers call `res.flushHeaders()` early (CVE-2026-123864 heap leak; cleartext node:http isn't affected). Rotate the TLS key on any such server you can't rule out.
- **Next:** anything using `http2.createSecureServer` or `http2.createServer`, and especially `stream.respondWithFile()` / `respondWithFD()` (CVE-2026-123874, -123875).
- **Auth checks:** servers that apply different client-certificate rules per hostname with `server.addContext()` (CVE-2026-123872, -123867), and clients that mix default and custom `ca` settings on one https.Agent (CVE-2026-123877).
- **Find versions fast:** `node -v` on hosts; in containers, check base image tags (`node:22`, `node:24`, `node:26`) and rebuild; Electron and bundled runtimes need their own vendor updates.
- **Logs:** grep for `ERR_PROXY_INVALID_CONFIG`; if proxy URLs with credentials appear, rotate those credentials (CVE-2026-123871).

Sources: [Node.js: Wednesday, November 11, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)