How to Update Node.js on Your xCloud Server
Updated October 29, 2026 · 5 min read
xCloud installs one Node.js version per server from the NodeSource package repository. Every Node.js site on the server, including n8n and Uptime Kuma sites, runs on it under PM2.
When you update Node.js, xCloud installs the new version and then gracefully reloads your running Node.js sites onto it, so a security fix takes effect right away. You only restart a site yourself if the dashboard tells you it could not be reloaded.
Node.js October 2026 Security Release
On 21 October 2026, Node.js released fixes for 10 vulnerabilities, 4 of them rated High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can lead to remote code execution in an app that decompresses Brotli data it receives. The other High issues affect DNS lookups and TLS certificate hostname checks. See the Node.js security release notes for the full list.
| Your server’s Node.js | Fixed version | What to do |
|---|---|---|
| Node.js 24 | 24.22.1 | Click Update Node.js |
| Node.js 22 | 22.23.4 | Click Update Node.js |
| Node.js 21, 20, 18, 16 or 14 | None, end of life | Change the server to Node.js 22 or 24 |
Node.js 26 also has a fix, 26.12.1, but xCloud offers Node.js 14, 16, 18, 20, 21, 22 and 24.
Which Sites Need the Update
Update Node.js on a server if it runs any of these:
- Node.js sites that run a server process, such as an API, an SSR app (server-side rendering) or a webhook receiver. How to deploy a Node.js application.
- n8n sites. Deploy n8n with xCloud.
- Uptime Kuma sites. Deploy Uptime Kuma with xCloud.
A quick test: if a site’s Rescue Site card shows Restart PM2 Process, the site runs on the server’s Node.js.
A static Node.js site only uses Node.js to build its files, and NGINX serves the result, so the Node.js vulnerabilities do not reach it while it runs. Update the server anyway, so your next build uses a supported version.
Docker apps, such as Custom Docker sites and Docker-based One Click Apps, ship their own runtime inside the image. Updating the server’s Node.js does not change them. Update the app’s image instead.
Step 1: Check for a Node.js Update
Open your server and go to Management → Node Configuration. In the Node.js Runtime Updates card, click Check for updates.
xCloud checks NodeSource for the newest release of your installed major version and shows the Installed version and the Latest same-major version. If they differ, you see A Node.js runtime update is available.
Step 2: Install the Update
Click Update Node.js. Check the versions in the confirmation, then click Yes, Update!
xCloud installs the new version, then reloads every running PM2 app on the server one at a time, including Node.js, n8n, Uptime Kuma and Lovable sites, so they run the new version. Apps you stopped stay stopped. The update usually takes under a minute. When it finishes, you see Node.js runtime updated successfully., and the card shows the new installed version and Node.js is up to date for this major version.
Step 3: Restart Any Site That Was Not Reloaded
If an app does not come back on the new version, the dashboard shows a warning that names the site: Some apps did not reload on the new runtime. Restart each site it names. If you updated Node.js before 22 October 2026, when xCloud started reloading apps automatically, restart each Node.js, n8n and Uptime Kuma site on that server the same way:
- Open the site and go to Settings.
- In the Rescue Site card, turn on Restart PM2 Process. You can leave the other switches as they are.
- Click Run Now, then Yes, Run Now.
The site restarts in a few seconds, so expect a brief interruption. If you deploy the site from Git, a new deployment restarts it too.
Step 4: Confirm the Site Runs the New Version
SSH in to the server as the site user, then run:
pm2 list
pm2 show <app-name> | grep "node.js version"Replace <app-name> with the name pm2 list shows. The node.js version line should show the fixed version, such as 22.23.4 or 24.22.1. If it still shows the old version, restart the site as in Step 3.
If Your Server Runs Node.js 21 or Older
Node.js 14, 16, 18, 20 and 21 are end of life and do not get the October 2026 fixes. For those servers, Check for updates can only move you to the newest release of the same old version, and can still say up to date.
Move the server to Node.js 24, or 22 if your app needs it. Choose the version under Default Node.js Version and click Save Changes. How to change the Node.js version.
A major version change can break an app, for example when a dependency stops supporting the new version. Test your app on a separate server with the new version first, back up your site, and plan a short maintenance window. After the change, restart or deploy each Node.js site again, as in Step 3.
If the Update Is Not Available
The Node.js Runtime Updates card tells you why it can’t update:
| Message | What it means |
|---|---|
| Node.js is not installed on this server. | There is nothing to update. Node.js is installed with the first Node.js site, or from Default Node.js Version. |
| xCloud can only update Node.js runtimes installed from the matching NodeSource repository. | Node.js came from a different package repository, for example one you added yourself. Change the server to Node.js 22 or 24 instead. |
| This Node.js runtime is not managed by the system package manager. | Node.js was not installed as a system package, for example Node.js 14, which xCloud installs from a nodejs.org download. Change the server to Node.js 22 or 24 instead. |
| The last check failed after this result was loaded. | Click Check for updates again before you update. |
Still stuck? Contact our support team for any of your queries.
FAQ
Which Node.js versions fix the October 2026 security release?
Node.js 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026. End-of-life versions, such as Node.js 20 and older, are affected and get no fix.
Does updating Node.js restart my sites?
Yes. After the update installs, xCloud gracefully reloads every running PM2 app on the server, including n8n and Uptime Kuma, so they run the new version right away. Apps you stopped stay stopped. If an app does not come back on the new version, the dashboard names the site, and you can restart it with Rescue Site → Restart PM2 Process or deploy it again.
The update card says Node.js is up to date. Am I safe?
Only if the installed version is 22.23.4, 24.22.1, 26.12.1 or newer in its line. The card compares versions within the same major version, so a server on Node.js 20 can show up to date and still be vulnerable, because Node.js 20 gets no more fixes.
Can I run different Node.js versions for different sites?
No. xCloud installs one Node.js version per server, and every Node.js site on that server uses it. To move one site to a different major version, put it on a server with that version.
Are my Docker apps updated by this?
No. Docker apps, such as Custom Docker sites and Docker-based One Click Apps, ship their own runtime inside the image. Update the app’s image instead.
Why does xCloud say it can only update runtimes installed from NodeSource?
xCloud updates Node.js through the NodeSource package repository it installed Node.js from. Node.js 14, which xCloud installs from a nodejs.org download, and a Node.js you installed yourself are not managed by that repository. Change the server to Node.js 22 or 24 from Default Node.js Version instead.