The three providers most developers actually deploy Node apps on, compared at the entry tier, then judged by what a Node workload really needs: CPU and RAM per dollar, egress limits, IPv4 policy, and reach. Plus the Node version to install and what to check before you push.…
Read more →On 28 October 2026 Node.js 26 becomes Active LTS. It is the last LTS promotion under the old even/odd release model, and the first window where the new annual cadence (v27 Alpha starts the same day) shapes your version choice. v24 moved to Maintenance on 20 October; v22 reaches end-of-life in April 2027. Worst of all, the version to move to - 26.12.1 - is also the one that carries the October HIGH security fixes, including the Node2Shell Brotli RCE. Here’s how to plan the move on a self-hosted VPS, what breaks when you jump from 24/22, and the exact check-install-verify commands.…
Read more →CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…
Read more →A copy-pasteable walkthrough for running a Next.js app on your own VPS - Node, PM2, Nginx reverse proxy and free SSL, end to end, in about 15 minutes.…
Read more →On 21 Oct 2026 the Node.js project released security versions across all three supported lines - 26.12.1 (Current), 24.22.1 and 22.23.4 (LTS) - closing four HIGH CVEs, three of them remotely reachable by default, plus six more medium/low issues. Node 26 becomes Active LTS on 28 Oct. How to check your version and upgrade on a self-hosted VPS with nvm or a direct tarball, then restart cleanly under pm2.…
Read more →Next.js 16.4.1 (14 Oct 2026) fixes two Critical unauthenticated RCEs - in use cache functions returning typed arrays and in the Image Optimization API with SVG - plus a High DoS in Server Actions. Here’s how to check if you’re vulnerable and the upgrade order for self-hosted apps.…
Read more →Node.js switches to an annual LTS cycle starting with v27. Every major becomes LTS after six months Current plus six months Alpha, with 30 months of support. What changes in cadence and version lifetime, and how to plan upgrades for Node apps on a self-hosted VPS.…
Read more →Every Node.js app that survives more than a week in production eventually asks the same question: what keeps it running when it crashes, and what brings it back when the server reboots? Two answers dominate - PM2, a Node-native process manager, and systemd, the init system already living inside virtually every modern Linux distribution. They are not competing at exactly the same layer. PM2 is a userspace daemon you install on top of the OS. systemd is the OS. Understanding where the boundary sits is the difference between a setup that quietly works for years and one that fights you every time you deploy. This guide walks through the real, documentation-backed behavior of each so you can pick deliberately. What each one actually is PM2 is a daemon process manager written for Node.js, installed via npm. You start it with npm install pm2@latest -g, then launch an app with pm2 start app.js. PM2 daemonizes the process, keeps it alive, and gives you a CLI to inspect status, tail logs, and reload the app.[1] Its headline feature for Node is cluster mode: with the -i flag it spans a workload across every available CPU with zero changes to your code.[2] …
Read more →