Production checklist
Node.js production checklist: 6 checks before launch
6 checks for running Node.js in production: 2 should-dos and 4 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (2)
Run an active or maintenance LTS release
Odd-numbered and end-of-life releases stop getting security fixes.
Verify from the command line
Run this where the app runs (or check the Docker base image and .nvmrc). The major version should be an Active or Maintenance LTS line on the Node.js health page.
node --version
Check dependencies for known vulnerabilities before each release
Most Node.js apps ship hundreds of packages; one vulnerable one is enough.
Verify from the command line
No high or critical findings in production dependencies. The free StackPrism check (/check) adds end-of-life and deprecation checks.
npm audit --omit=dev
Good to have (4)
Apply the Node.js security best practices
Covers HTTP request limits, dependency hygiene and prototype pollution.
How to verify
Read the threat list on that page (denial of service, DNS rebinding, exposed files, prototype pollution, supply chain) and note how your server handles each one.
Install with
npm cifrom a committed lockfileProduction then runs exactly the versions you tested, not whatever was newest at deploy time.
Check the config
Your CI and Dockerfile install with npm ci, and package-lock.json is committed.
RUN npm ci --omit=dev
Set request and header timeouts on the HTTP server
Slow clients that never finish a request otherwise hold connections open until the server runs out.
Check the code
The HTTP server sets requestTimeout and headersTimeout to values that fit your slowest real request.
server.requestTimeout = 30_000; server.headersTimeout = 10_000;
Let the process crash on uncaught exceptions and restart it
After an uncaught exception the process is in an unknown state; Node.js advises restarting rather than carrying on.
Check the config
A process manager or the platform restarts the app when it exits (systemd Restart=always, a container restart policy, PM2), and no uncaughtException handler keeps a broken process serving.
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.