Okta patches Cloud Services after Node.js security releases
Original title: Node.js Project: November 11 Security Releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
Okta said it is applying patches across its Cloud Services environments after the Node.js Project’s November 11 security disclosures. The notice lists 16 CVE identifiers. Okta and Auth0 say they have observed no evidence of exploitation. Customers using Auth0 Actions are told to update the runtime to Node 22 and deploy changes unless they are already on Node 22. Customers of listed Okta and Auth0 Node.js SDKs are told to update their Node.js runtime to the latest patched version.
Unconfirmed: The notice does not describe the individual flaws or confirm that every listed CVE affects Okta.
- Sixteen CVEs are named, from CVE-2026-123828 through CVE-2026-126051.
- Auth0 Actions customers already on Node 22 do not need to redeploy.
- Named SDKs include node-auth0, nextjs-auth0, express-openid-connect, and okta-sdk-nodejs.
- The notice does not describe what each Node.js flaw allows.
| Product | Affected | Fixed in |
|---|---|---|
| Node.js Project Node.js | — | latest patched version |
| Okta Auth0 Actions | — | Node 22 |
- 1.Update the Auth0 Actions runtime to Node 22 and deploy changes unless already on Node 22.
- 2.Update the Node.js runtime to the latest patched version for listed Okta and Auth0 SDKs.
- CVEs
- CVE-2026-123863CVE-2026-123864CVE-2026-123865CVE-2026-123866CVE-2026-123867CVE-2026-123868CVE-2026-123871CVE-2026-123872CVE-2026-123874CVE-2026-123875CVE-2026-123877CVE-2026-123828CVE-2026-123829CVE-2026-123862CVE-2026-123873CVE-2026-126051
- Vendors
- OktaNode.js Project
- Products
- Node.jsAuth0Auth0 Actions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123863 | Unauthenticated HTTP/2 assertion crash in Node.js | 8.2 group max | — | ||
| CVE-2026-123873 | — | — | — |
From the original article
1 min read at sec.okta.com
On November 11, 2026, the Node. js project released security updates addressing multiple vulnerabilities across core modules. Read on for Okta's response and customer recommendations.
sec.okta.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.