You upgraded Node.js for the October security release. PM2 might still be on the old one.

On October 21, Node.js released security updates for all supported versions, addressing ten CVEs, four of which were rated High. The most critical issue, CVE-2026-111497, involves a Brotli decoder out-of-bounds write. This flaw allows an attacker to corrupt process memory, potentially leading to a crash, disclosure of sensitive data, or even remote code execution. There are no known workarounds, so upgrading to the patched version is essential.

For self-managed Virtual Private Servers (VPS), upgrading Node.js is not the same as updating PM2. To verify the Node.js version running your application, use the command "node -v". Similarly, to check which version PM2 is currently running, utilize the command "pm2 info my-app | grep -i node.js version". If the versions differ, it's crucial to ensure that the version being run by your application is the patched one.

Be cautious of two potential pitfalls. First, PM2's daemon retains the Node.js binary it was initially started with. Simply restarting PM2 does not update the binary. Second, if Node.js was installed using nvm, the systemd unit generated by pm2 startup may reference an outdated path. To resolve this issue, regenerating the systemd unit with the "pm2 unstartup systemd" and "pm2 startup systemd" commands followed by a system reboot is required.

Additionally, global packages managed by nvm are version-specific. To update PM2 globally, reinstall it or use "nvm install 24 --reinstall-packages-from=current" to apply updates to all installed packages. If you're using Docker containers, remember that the host's Node.js version does not impact the container. Running "docker exec container node -v" will reveal the container's Node.js version.

If you're still operating on an outdated version of Node.js, such as 20, which is now End-of-Life (EOL), it's important to move to a supported version like 22 or 24. Although Node.js projects acknowledge that End-of-Life versions will be impacted by new security releases, they will not receive fixes. Before upgrading to a new major version, test your application thoroughly and, if necessary, utilize "npm rebuild" for native modules.