A critical Node.js vulnerability is published. What happens?

The update is on us: Node.js is kept up to date through regular, scheduled updates, along with the operating system and the components around it. That is precisely the layer you should not have to watch — and the one that, on a self-administered VPS, is most often behind.