[otaki0413]

Why

Pick up the Node.js November 2026 security release so CI and local tooling run 26.13.1.

The Wednesday, November 11, 2026 security releases name Node.js v26.13.1 as the 26.x fix (with v24.22.3 and v22.23.5).

Pins that changed

• .github/workflows/ci.yml: node-version 26.13.0 → 26.13.1 (voidzero-dev/setup-vp)
• AGENTS.md: nvm install / nvm use and the CI note 26.13.0 → 26.13.1
• README.md: the CI version 26.13.0 → 26.13.1

No other 26.13.0 string remains in the repo. There is no .nvmrc or .node-version, and none was added.

Left as they are:

• package.json engines.node stays >=26. That is the major floor, not a 26.13.0 pin.
• pnpm-workspace.yaml minimumReleaseAge stays 1440.
• @types/node stays 26.6.6. npm's 26 line ends at 26.6.6 (registry modified 2026-10-28T18:36:37Z). No newer 26.x types release exists, so there is nothing newer that clears the 1440-minute gate. This security release does not publish a types package.
• wrangler 4.157.0, @cloudflare/vite-plugin 1.67.0, vite-plus 1.5.0, and pnpm 12.17.0 were not bumped. Install, check, test, build, and cf-typegen --check passed on Node 26.13.1 without them.
• wrangler.jsonc does not need a change. compatibility_flags stays ["nodejs_compat"] and compatibility_date stays 2026-11-05. That flag enables workerd's Node-compatible APIs. It does not select a Node.js patch.

npm undici

Node.js v26.13.1 updates the undici copy inside the Node binary to 8.12.4 and llhttp to 9.4.4. Installing 26.13.1 picks those up.

The lockfile also has undici@7.30.1, required exactly by miniflare 5.20261103.0-beta (pulled in by wrangler 4.157.0) for local simulation. That npm copy is not Node's bundled undici. The patched 7.x release is undici@7.30.2, published 2026-11-05T09:06:58Z, which is older than 1440 minutes. No override was added. Changing it would be a Wrangler/miniflare dependency change, and the 26.13.1 verification did not require it.

Which CVEs matter here

Production runs on workerd. These fixes land in the Node.js 26 process used for CI, local dev, and the build. They do not change the deployed Worker.

Relevant to that Node process (vp, pnpm, Wrangler CLI):

• CVE-2026-123877 (medium) — https.Agent can reuse a TLS session authenticated under a different CA policy.
• CVE-2026-123871 (medium) — an invalid proxy URL can print proxy credentials in ERR_PROXY_INVALID_CONFIG, when a proxy is configured for the Node process.
• CVE-2026-123864 (high, llhttp) — a zero-length TLS write can re-enter llhttp_execute() on an HTTPS server. The advisory says cleartext node:http is not affected. Default vp dev is cleartext HTTP on port 5173.
• Bundled undici 8.12.4 (the same public fixes as npm undici@7.30.2): CVE-2026-116592, CVE-2026-120474, CVE-2026-116630, CVE-2026-120415, CVE-2026-120222, CVE-2026-120423. The cache-poisoning and cache-replay bugs need undici's compose(redirect(), cache()) path. Node's fetch still gets the redirect credential-stripping fix (CVE-2026-120415) and the SRI whitespace fix (CVE-2026-120423).

The same 26.13.1 binary also fixes Node HTTP/2 and TLS server bugs. This template does not serve HTTP/2 from Node, and it does not terminate TLS in the Node process (Vite's dev server is HTTP/1; CI does not start a Node HTTP/2 or TLS server). They ship because CI and local tooling now run that binary:

• High: CVE-2026-123863, CVE-2026-123865, CVE-2026-123866, CVE-2026-123874, CVE-2026-126051, CVE-2026-123872
• Medium: CVE-2026-123828, CVE-2026-123867, CVE-2026-123868, CVE-2026-123875
• Low: CVE-2026-123829 (permission-model fs.watch name leak), CVE-2026-123862 (zlib params/destroy), CVE-2026-106071 (permission-model wildcard over-grant)

The v26.13.1 release notes also list CVE-2026-123873 (permission model, heap snapshot path). That is Node's --permission model, not workerd.

workerd does not run Node's nghttp2 HTTP/2 stack, Node's TLS handshake callbacks, Node's llhttp, Node's permission model, or the undici build shipped inside the Node 26 binary. nodejs_compat stays as it is.

Verification

Node v26.13.1, npm 11.20.0, pnpm 12.17.0:

• pnpm install — exit 0. Lockfile passed supply-chain policies (377 entries) and was up to date. 219 packages installed. A second run after the pin edit reported "Already up to date" (exit 0).
• pnpm check — exit 0. All 16 files formatted. No lint or type errors in 7 files.
• pnpm test — exit 0. 1 file, 1 test passed (Vitest 5.1.0).
• pnpm build — exit 0. Client and SSR/workerd bundles built. Rolldown printed a SOURCEMAP_BROKEN warning from vite:css-post during the server build; this PR does not change that plugin or any CSS, and the command still exited 0.
• pnpm exec vp run cf-typegen --check — exit 0. wrangler 4.157.0: "Types at worker-configuration.d.ts are up to date."

  

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T10:01:24.038826Z	f3ce5e1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.