# CISA Requires Agencies Patch Node.js Flaw

CISA added actively exploited Node.js vulnerability CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, requiring federal civilian agencies to patch affected systems by **November 10, 2026—three days from now**. Agencies must upgrade supported Node.js release lines to 22.23.4, 24.22.1, or 26.12.1; versions 20, 23, and 25 are unsupported and have no official fix, and no workaround is available. Contractors supporting federal systems should coordinate with agency customers to identify affected deployments and plan remediation, including replacement or migration where unsupported versions are in use.

- Federal civilian agencies are required to meet the November 10 deadline. Contractors operating or maintaining systems for those agencies may need to support inventory, upgrade, and remediation work.
- Organizations should identify Node.js deployments and release lines promptly; unsupported branches have no official patch or workaround, making upgrade planning especially urgent.
- Procurement and program teams should assess whether affected systems are covered by contractor-operated services or support agreements and coordinate remediation responsibilities with the relevant agency.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 06, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Sources
- [CISA sets November 10 deadline for high-severity Node.js flaw](https://gcn.com/node-js-flaw-cisa-sets-november/23046) - gcn.com