DEV Community

Vpsfordev
Vpsfordev

Posted on Originally published at vpsfor.dev

You upgraded Node.js for the October security release. PM2 might still be on the old one.

#javascript #node #devops #security

On 21 October Node.js shipped security releases for every supported line: 22.23.4, 24.22.1 and 26.12.1. Ten CVEs, four rated High. The headline one is CVE-2026-111497, a Brotli decoder out-of-bounds write. In the official wording: an attacker who can supply Brotli data that an application decompresses with node:zlib "can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution."

There are no workarounds. You upgrade. And on a self-managed VPS, "I upgraded" and "my app is running the patched Node" are two different things.

Check what your app is actually running 

node -v                                        # your shell
pm2 info my-app | grep -i "node.js version"    # what PM2 is really running
docker exec <container> node -v                # inside containers
Enter fullscreen mode Exit fullscreen mode

Only the version your running app reports counts.

Trap 1: the PM2 daemon keeps the old binary

PM2's daemon stays on the Node it was started with. pm2 restart doesn't change that.

pm2 update
pm2 info my-app | grep -i "node.js version"
Enter fullscreen mode Exit fullscreen mode

Trap 2: nvm + pm2 startup hardcodes the old path

If you installed Node with nvm, the systemd unit from pm2 startup points at something like ~/.nvm/versions/node/v22.x.x/bin. Everything looks fine until the next reboot — then PM2 comes back on the old, vulnerable Node. Regenerate it:

pm2 unstartup systemd   # if it prints a sudo command, run that
pm2 startup systemd     # run the sudo command it prints
pm2 save
Enter fullscreen mode Exit fullscreen mode

Also remember global packages are per-version under nvm — reinstall PM2 or use nvm install 24 --reinstall-packages-from=current.

Trap 3: Docker doesn't care what's on the host 

docker build --pull --no-cache -t my-app .
docker run --rm my-app node -v
Enter fullscreen mode Exit fullscreen mode

And if your Dockerfile pins an exact tag like node:24.10.0-alpine, it will never pick up a fix until you bump it.

Still on Node 20?

It's end-of-life. The Node project's stance is that EOL versions are always affected by new security releases and won't be fixed. Move to 22 or 24 — just test first if you're jumping majors (npm rebuild for native modules).

Full guide — the other High-severity CVEs (two TLS hostname bypasses, a DNS NUL-truncation bug), NodeSource/apt upgrades, and testing before a major-version jump: vpsfor.dev →

Top comments (0)