HubSpot Custom Code Actions and Node.js 24: What to Do Now

On October 21, 2026, the Node.js project released security updates for several vulnerabilities, including a decompression flaw that could let an attacker run code remotely. Then HubSpot emailed customers whose accounts have custom code actions: those actions run on Node.js 16 or 20, which no longer get fixes, and the steps it recommends are steps to take now. On this HubHeroes episode, George B. Thomas read that email on air, Max Cohen of hapily admitted it was hard to follow, and Chad Hohn, who upgraded his own company's custom coded actions the same day, walked through what to actually do.

Here's the short version. Upgrade to Node.js 24 before November 17, 2026. Use the moment to retire any custom coded action a native workflow action can now handle. Test everything, and tell your stakeholders. And if you've got an AI assistant connected to your portal, Chad dictated the prompt he'd give it. It's below, as Chad's Dope Prompt.

Why Custom Coded Actions Exist in the First Place

George opened by asking Max if he'd ever dealt with custom coded workflows. He had: asking ChatGPT to make one, then smashing his head against the keyboard testing it over and over again. George said he's been on the same journey, with Claude doing the assisting.

Chad's explanation: workflow actions are predefined. They're a step, they do a thing. When there's no step for the thing you want, a custom coded action (CCA) fills the gap. It takes Operations Hub Pro or Data Hub Pro, which, Chad joked, HubSpot has rebranded "like nine times in the last two years."

The alternative is middleware like Zapier or Make: something happens, the middleware transforms the data and gets it back in there. But then, as Chad put it, you gotta pay per zip.

Max pointed out how much this has changed. When one of the guys at hapily hits something workflow actions just can't do, his next question is whether the customer has Data Hub. If they do, a custom coded action is on the table, and the conversation has moved from working with a partner to whipping it up yourself.

That ease has a flip side. George named the stress of the "mere mortal" human who isn't AI activated, or is only lightly AI activated: you finally get a custom coded workflow through testing, sigh with relief, and forget it's back there running. Then an email like this one shows up.

What HubSpot's Email Actually Said

The email promised custom code actions in HubSpot workflows and "the steps we recommend you take now." George stopped right there. Not later, not soon. Now. Here's the rest of it in plain language, from what he read on air:

• Custom code actions in HubSpot workflows currently run on Node.js 16 or 20. Neither the Node.js project nor AWS supports those versions anymore, so they won't receive a fix.
• To exploit it, your code would need to make a request to a server an attacker controls, or to a legitimate server an attacker has compromised, and then process the response. In that scenario, an attacker could potentially access the secrets configured for that specific custom code action, such as API keys and access tokens, and use them to reach the systems those credentials allow.
• HubSpot said it has no evidence the vulnerability has been exploited and is actively monitoring. Node.js 24 is now available.

Max's honest reaction: "It's kinda hard for me to follow, to be honest." George, who's been using HubSpot since 2012, said that's exactly why he read it through on purpose. What were the action items? Who are you supposed to call? Max had the answer: "I would call Chad."

Chad's take on why it matters: his understanding is the flaw was found behind closed doors at one of the frontier AI labs, using a model consumers don't get to use, and the details of how it works haven't been released. That's no reason to be lackadaisical. Your custom coded actions don't only hold HubSpot API keys. They can hold an API key for any other system, your legal contracting software included. That's why he upgraded all of his company's CCAs the same day.

The Deadlines the Email Didn't Spell Out

Near the end, Max asked the question plenty of humans are asking: you can't make new ones today, but did HubSpot give a timeline for when they'd stop working? Max couldn't remember, and George said the email basically just says do it now. They literally used the word "now."

HubSpot's Node.js 24 upgrade guide has the answers. Here's what it says:

• Node.js 16 and 20 "no longer receive security updates."
• As of November 3, 2026, you can't create new custom code actions on Node.js 20. Upgrade before November 17, 2026. From November 17, existing Node.js 20 actions can't be saved, and rolling an action back to Node.js 20 is only possible until then. Existing Node.js 20 actions keep running after both dates, on a version that no longer gets security updates.
• The code changes shape. Remove the callback parameter, make exports.main async, and return your output fields instead of calling callback. Await all async work before you return.
• Libraries change too. @hubspot/api-client moves from version 11 to 13, request isn't included (use axios or fetch), and aws-sdk is added.
• HubSpot recommends "Upgrade with Breeze," a button inside the custom code action. The guide also says Breeze can make mistakes, so check that every output is still returned. Testing writes to the record you select, and the HubSpot CLI can't update custom code actions.

Chad called out the library jump on air. On Node.js 20, he said, the googleapis library was version 67. On Node.js 24? 171.4. (George guessed 98 and admitted he was way off.) His lesson: when HubSpot upgrades the libraries, reevaluate your custom coded actions. He likes the new AWS SDK, too, because it lets you use more native AWS features right inside the runtime. In his words, this kicked HubSpot in the butt to upgrade. If this feels familiar, the same Node.js 24 move already hit chatbot custom code in HubSpot Chatflows.

Chad's Playbook, Step by Step

George asked Chad to talk everybody off the ledge. Here's what Chad does, in the order he said it.

Ask whether you still need it. Chad removes CCAs wherever he can, and called it part of the workflow audit we covered in the micro and macro audits episode. HubSpot has released, in his words, about one bazillion additional workflow actions, including removing associations, adding association labels, and pulling associated records filtered by labels. Fewer CCAs helps in another way, too. Chad said a HubSpot API key used across many CCAs has a rate limit of 100 API calls per 10 seconds. When a bunch of stuff happens at once, you can clog it, and it can fail with a 429 error, which is your API saying, "yo, dude, slow down." George's reframe: it's a real choice. Rebuild with native functionality, or upgrade to Node.js 24 and make it safe.

Snapshot before you touch anything. Save a copy of every CCA exactly as it is right now, so you can revert. Chad's assistant does this as standard practice. George told him to say it anyway, because that isn't how everybody works with their assistant.

Decide between Breeze and your own assistant. The "Upgrade with Breeze" button works, but Chad said it does it in a vacuum, one workflow at a time, and it's probably not gonna be checking the outputs for you. That's why he prefers his own assistant, even though Breeze "can totally upgrade it."

Check your scopes. If your external assistant works through an API key, make sure it has the workflow scope, meaning permission to create, edit and update workflows. If you're already connected to Claude, disconnect and reconnect to pick up new scopes. The super admin also needs to turn the scopes on in the portal's app permissions (we've covered what the Claude connector's scopes can reach before). Workflows have been added to the HubSpot agent CLI, too, so an assistant without a strong native connector can work through the command line instead.

Move legacy private app keys to service keys. Private apps are called legacy apps now, and Chad thinks they'll stop working sometime next year. Open the legacy app in a tab, see what permissions it has (something like crm.objects.contacts.read), and make sure the service key has the same. Then rotate the token inside the secret. You keep the same secret name, so the code doesn't break. Here's how to create HubSpot service keys without a developer, and how HubSpot agents can now rotate app secrets.

Test it, then keep watching. Trigger whatever enrolls a record, if you can. If it only fires on a real production event, like a signed contract, wait for it and have your assistant run a daily scan to validate that it's doing what it needs to, because callbacks and outputs work differently in Node.js 24. Max's version: "Test it. Test it. Test it."

Communicate. Chad had his assistant draft one message for every stakeholder who deals with HubSpot at a high level, plus IT security: what's coming in, what we're doing in response, and that we're already on it. For him that's the marketing ops person, the RevOps lead and a couple of IT humans. Bonus: he doesn't get forwarded 75 copies of the same email.

Chad's Dope Prompt

George promised this one on the show: "I'm gonna ask our agent to just take those words and create the prompt of prompts for you in the show notes." Then Chad added a daily check "to the prompt of prompts, George's Claude, please." Here it is, built from what Chad said on air. Paste it into Claude, ChatGPT, or whichever assistant is connected to your portal, and attach HubSpot's email and the Node.js 24 upgrade guide.

Yo, I just got an email from HubSpot about custom coded actions in our workflows. There's a Node.js security vulnerability, and HubSpot says our custom code actions run on Node.js 16 or 20, which no longer get security fixes. I want every one of them reviewed, cleaned up where we can, and safely upgraded to Node.js 24. Work through this in order, and be meticulous:

• 1. Read the HubSpot email and HubSpot's "Upgrade custom code actions to Node.js 24" developer doc, start to finish, before you touch anything.
• 2. Confirm you have every scope you need, including the workflow scope (permission to create, edit and update workflows). If you don't, tell me what to turn on and whether I need to disconnect and reconnect you.
• 3. Review every custom code action across every workflow in our portal: the workflow name, its trigger, what the action does, its Node.js version, the secrets it uses, and the output fields it returns.
• 4. Snapshot each custom code action exactly as it is right now (code, secrets referenced, inputs and outputs) so we can revert.
• 5. Flag every custom code action a native workflow action can now replace. HubSpot has released a lot of new workflow actions, including removing associations, adding association labels, and pulling associated records filtered by label. Go per object type and double check what's available in the workflow UI, even after you've checked the documentation, so we're on the same page.
• 6. Propose a comprehensive plan: which actions to replace with native workflow actions, which to upgrade, and in what order. Then stop and wait for my approval. Don't change anything until I say go.
• 7. Once I approve, draft one message for everyone who works in our HubSpot portal at a high level, plus IT security: what's coming in, what we're doing in response, and that we're already on it. Draft a second one for when we're done.
• 8. Upgrade the actions we're keeping to Node.js 24: remove the callback parameter, make exports.main async, return the output fields instead of calling callback, await all async work before returning, and update library usage (@hubspot/api-client 13, and axios or fetch instead of request).
• 9. If any action uses a legacy private app token, move it to a service key with the same scopes. Rotate the token inside the secret and keep the same secret name, so the code doesn't break.
• 10. Test each upgraded action on a test record I approve (testing writes to that record), and confirm every output field is still returned.
• 11. Before you call anything done, have a separate sub-agent act as an adversarial reviewer of your work. Fix what it finds, but don't loop forever on nitpicks.
• 12. Schedule a daily check of every upgraded workflow until each one has fired in production and done the correct actions. Take workflows off the list as you confirm them, and tell me which are confirmed and which you're still monitoring.

Tweak it for your portal. "Be meticulous" is Chad's line. Max ends his prompts with "no mistakes," and George asks AI to double and triple check its work. Use whichever one you'd actually say.

No Mistakes, Be Meticulous, Double and Triple Check

Max shared his favorite prompt trick. When he's rebuilding part of an interface, he screenshots it, asks for a pixel perfect recreation, and adds "no mistakes" at the end. It started as an inside joke. Then he noticed that without it, he'd get little mistakes, like a button that's too big or runs off the screen. With it, the work came back immaculate. Chad usually says "be meticulous." George says "please make sure you double and triple check your work." Chad's note: it burns way more tokens.

Chad's bigger idea is a separate sub-agent that reviews the work as an adversarial reviewer. The thing that built it, he said, kind of like a human, isn't always super critical about what it built.

His one warning: don't go too deep in that loop. ChatGPT could spend six hours on a fifteen minute task if you let it, and eventually they just get nitpicky. George loved the adversarial reviewer, especially for these custom coded workflow actions.

While you're in your workflows, look at the rest of the portal too. The free HubSpot Portal Audit Checklist gives you a place to start, and the portal audit checklist every admin should review walks through the bigger picture.

Be a happy, helpful, humble human and do some happy HubSpotting.