Software47 mOctober 28, 2026, 20:16

After Node.js security patches, PM2 may still run the vulnerable version

On 21 October Node.js shipped security releases 22.23.4, 24.22.1 and 26.12.1 fixing ten CVEs, including High-severity CVE-2026-111497, an out-of-bounds write in the Brotli decoder in node:zlib that can lead to remote code execution. The PM2 daemon and the systemd unit from pm2 startup keep the old Node binary, so apps can stay on the vulnerable version after upgrading.

DEV Community

Open source

After Node.js security patches, PM2 may still run the vulnerable version

Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 CVEs, four rated High
CVE-2026-111497 in the node:zlib Brotli decoder allows RCE with no workarounds
pm2 restart does not change the daemon's Node version; pm2 update is required
pm2 startup with nvm hardcodes the old path and reverts to vulnerable Node after reboot

#Node.js#PM2

AWS launches Lambda Web Functions for running HTTP servers without adapters

Security

HiddenLayer: decision models like Jev are still vulnerable to prompt injection

Security

Python Brotli and brotlicffi packages vulnerable to Node2Shell exploit

Security

After Node.js security patches, PM2 may still run the vulnerable version

AWS launches Lambda Web Functions for running HTTP servers without adapters

HiddenLayer: decision models like Jev are still vulnerable to prompt injection

Python Brotli and brotlicffi packages vulnerable to Node2Shell exploit

56 million PHP fingerprints do not mean vulnerable hosts