Security
Go to Okta.com ↗
‹ Back to blog

Node.js Project: November 11 Security Releases

Okta

What happened?

On November 11, 2026, the Node.js project released security updates addressing multiple vulnerabilities across core modules, including authentication bypasses in TLS certificate handling, memory-safety defects in HTTP request parsing and HTTP/2 session handling, denial-of-service conditions, and information disclosure in proxy configuration, 8.0.5 (CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123872, CVE-2026-123874, CVE-2026-123875, CVE-2026-123877, CVE-2026-123828, CVE-2026-123829, CVE-2026-123862, CVE-2026-123873, CVE-2026-126051)

Okta's response

  • No Evidence of Exploitation: Our assessment identified no exploitable exposure in Okta or Auth0 production environments.

Do I need to do anything?

  • Customers using the Auth0 AD/LDAP connector: We recommend downloading and installing the latest version, v8.0.5.

  • Customers using Auth0 Actions: We recommend updating the runtime to Node 22 and deploying your changes. Customers already on Node 22 do not need to redeploy.

  • Customers using Okta or Auth0 Node.js SDKs: We recommend updating your Node.js runtime to the latest patched version across:

    • node-auth0

    • nextjs-auth0

    • express-openid-connect

    • passport-auth0

    • node-jsonwebtoken

    • okta-sdk-nodejs

    • okta-oidc-middleware

    • okta-jwt-verifier-js.

References

Okta