Upgrade

Next.js Nov 2026 Security Release: Patch to v16.4.5

The Next.js security release is out. Vercel shipped v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) on November 3, 2026, closing seven advisories: one high severity and six medium. If you self-host, the patched code only reaches production when you update the dependency, rebuild the standalone artifact, and restart the process. This guide maps all seven advisories to their affected surfaces, calls out the ones that matter most for a self-hosted stack in front of nginx, and walks through the exact update sequence for a standalone build under PM2.…

Read more →

Node.js 26 Is Active LTS: 24/22 Migration Plan

On 28 October 2026 Node.js 26 becomes Active LTS. It is the last LTS promotion under the old even/odd release model, and the first window where the new annual cadence (v27 Alpha starts the same day) shapes your version choice. v24 moved to Maintenance on 20 October; v22 reaches end-of-life in April 2027. Worst of all, the version to move to - 26.12.1 - is also the one that carries the October HIGH security fixes, including the Node2Shell Brotli RCE. Here’s how to plan the move on a self-hosted VPS, what breaks when you jump from 24/22, and the exact check-install-verify commands.…

Read more →

Node.js Oct 2026 Security: 26.12.1 and Node 26 LTS

On 21 Oct 2026 the Node.js project released security versions across all three supported lines - 26.12.1 (Current), 24.22.1 and 22.23.4 (LTS) - closing four HIGH CVEs, three of them remotely reachable by default, plus six more medium/low issues. Node 26 becomes Active LTS on 28 Oct. How to check your version and upgrade on a self-hosted VPS with nvm or a direct tarball, then restart cleanly under pm2.…

Read more →

nginx 1.31.7 / 1.30.6: Five Security Fixes to Apply

nginx 1.31.7 (mainline) and 1.30.6 (stable) fix five medium-severity CVEs shipped 14 Oct 2026: alias+rewrite buffer overflow, script-expression overflow, HTTP/3 body injection, TLS session-ticket forgery, and an AIO/SSI use-after-free. How to tell which of your configs are in scope, and how to upgrade.…

Read more →

Next.js 16.4.1: Security Fixes for Self-Hosted Apps

Next.js 16.4.1 (14 Oct 2026) fixes two Critical unauthenticated RCEs - in use cache functions returning typed arrays and in the Image Optimization API with SVG - plus a High DoS in Server Actions. Here’s how to check if you’re vulnerable and the upgrade order for self-hosted apps.…

Read more →

Node.js Annual LTS Cycle: What v27 Means on a VPS

Node.js switches to an annual LTS cycle starting with v27. Every major becomes LTS after six months Current plus six months Alpha, with 30 months of support. What changes in cadence and version lifetime, and how to plan upgrades for Node apps on a self-hosted VPS.…

Read more →

Next.js 16.4 Cache Components and Self-Hosting

Next.js 16.4 (stable, 6 Oct 2026) makes Cache Components the recommended default, ships with React 19.3, slims dev memory/disk usage, and adds next upgrade –agent. Here’s the practical read for anyone hosting Next.js on their own VPS behind nginx and PM2.…

Read more →

PostgreSQL 19 Upgrade: From 18 to GA on a VPS

PostgreSQL 19 is close to general availability. What actually changed for self-hosted databases on a VPS, which beta features got pulled, and a step-by-step pg_upgrade plan from 18 you can run when GA lands.…

Read more →

nginx 1.31.6: HTTP/3 Heap Overflow CVE-2026-90439

nginx 1.31.6 (and 1.30.5) fix CVE-2026-90439, a heap buffer overflow in the HTTP/3 module that fires when running OpenSSL 3.5.0 and earlier. How to tell if your reverse proxy is affected, and how to upgrade.…

Read more →