{
  "id": 16901799,
  "title": "You upgraded Node.js for the October security release. PM2 might still be on the old one.",
  "url": "https://urgent.news/2026/10/28/you-upgraded-node-js-for-the-october-security-release-pm2-might-still",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T13:16:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vpsfordev/you-upgraded-nodejs-for-the-october-security-release-pm2-might-still-be-on-the-old-one-4n30"
  },
  "original_language": "en",
  "account": "On October 21, Node.js released security updates for all supported versions, addressing ten CVEs, four of which were rated High. The most critical issue, CVE-2026-111497, involves a Brotli decoder out-of-bounds write. This flaw allows an attacker to corrupt process memory, potentially leading to a crash, disclosure of sensitive data, or even remote code execution. There are no known workarounds, so upgrading to the patched version is essential.\n\nFor self-managed Virtual Private Servers (VPS), upgrading Node.js is not the same as updating PM2. To verify the Node.js version running your application, use the command \"node -v\". Similarly, to check which version PM2 is currently running, utilize the command \"pm2 info my-app | grep -i node.js version\". If the versions differ, it's crucial to ensure that the version being run by your application is the patched one.\n\nBe cautious of two potential pitfalls. First, PM2's daemon retains the Node.js binary it was initially started with. Simply restarting PM2 does not update the binary. Second, if Node.js was installed using nvm, the systemd unit generated by pm2 startup may reference an outdated path. To resolve this issue, regenerating the systemd unit with the \"pm2 unstartup systemd\" and \"pm2 startup systemd\" commands followed by a system reboot is required.\n\nAdditionally, global packages managed by nvm are version-specific. To update PM2 globally, reinstall it or use \"nvm install 24 --reinstall-packages-from=current\" to apply updates to all installed packages. If you're using Docker containers, remember that the host's Node.js version does not impact the container. Running \"docker exec container node -v\" will reveal the container's Node.js version.\n\nIf you're still operating on an outdated version of Node.js, such as 20, which is now End-of-Life (EOL), it's important to move to a supported version like 22 or 24. Although Node.js projects acknowledge that End-of-Life versions will be impacted by new security releases, they will not receive fixes. Before upgrading to a new major version, test your application thoroughly and, if necessary, utilize \"npm rebuild\" for native modules.",
  "summary": "On 21 October Node.js shipped security releases for every supported line: 22.23.4, 24.22.1 and 26.12.1 . Ten CVEs, four rated High. The headline one is CVE-2026-111497 , a Brotli decoder out-of-bounds write. In the official wording: an attacker who can supply Brotli data that an application decompresses with node:zlib \"can corrupt process memory, which can lead to a crash, disclosure of process…",
  "key_points": [
    "Node.js released security updates on October 21, addressing ten CVEs",
    "CVE-2026-111497 is a critical Brotli decoder out-of-bounds write flaw",
    "Verify PM2 and Node.js versions separately to ensure patched version"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}