How long can I get extended support for Node.js 18?

Extended support duration varies by vendor. Most commercial ELS providers offer 1–3 year extended windows past the official EOL date. Most commercial ELS providers offer 1–3 year contracts. Some vendors offer indefinite support while subscription is active. Organizations should factor in their migration timeline when selecting a support window.

Should I migrate to Node.js 22 or get extended support?

If migration to Node.js 22 (LTS, supported until April 2027) can be completed within 6–12 months, migration is almost always the better long-term path. Extended support is the right choice when migration is blocked by compatibility constraints, regulatory change-freeze windows, or resource limitations. ELS buys time — it is not a permanent substitute for upgrading.

Node.js 18 End of Life: Which Vendors Offer Extended Security Support?

Q: Which vendors offer extended security support for Node.js 18 after end of life?

Commercial vendors provide extended lifecycle support (ELS) for Node.js 18 past its EOL date. Options exist covering ongoing CVE patching, compliance documentation, and multi-year contracts. Vendors differ in patch turnaround time, CVSS threshold, and coverage scope.

Q: What are the risks of running Node.js 18 past its EOL date?

Running Node.js 18 after April 30, 2025 means any newly disclosed CVE against that runtime will never be patched by the upstream project. Vulnerability scanners may stop flagging issues against EOL versions, creating a false sense of security. Regulatory frameworks including SOC 2, PCI DSS, and ISO 27001 typically require running supported software — EOL components can trigger audit findings.

By Scott Bissett Updated: May 24, 2026 EOL: April 30, 2025 5 min read

Node.js 18 is end of life. It has not received security patches since April 30, 2025. Any CVE disclosed after that date is a permanent unpatched vulnerability in your production environment. Organizations running Node.js 18 need either a migration plan or a commercial extended support contract — now.

Key Dates at a Glance

Node.js 24: active support ends 2026-10-20; end of life 2028-04-30
Node.js 22: active support ends 2025-10-21; end of life 2027-04-30
Node.js 18: active support ends 2023-10-18; end of life 2025-04-30
Node.js 12: active support ends 2020-10-20; end of life 2022-04-30
Node.js 7: end of life 2017-06-30
Node.js 6: active support ends 2018-04-30; end of life 2019-04-30

Node.js 18 lifecycle timeline

Active LTS
Oct 2022 – Oct 2023

Security only
Oct 2023 – Apr 2025

EOL
Apr 30, 2025 ✕

Node.js 18 entered its Active LTS phase in October 2022 and moved to security-maintenance-only in October 2023. The OpenJS Foundation ended all support on April 30, 2025. No further patches will be released for any CVE, regardless of severity.

Running Node.js 18 past end of life?

Extended support past the official EOL date exists for many products in this position — whether it covers Node.js 18 is exactly what we check. Tell us where to reach you and we’ll reply with matched options and pricing guidance — or an honest “no vendor covers this.” Free, no obligation.

Which vendors offer extended CVE patches for Node.js 18?

Several commercial vendors have built extended lifecycle support programs specifically for EOL Node.js versions. Here is a comparison of the main options available as of 2026:

Third-Party ELS Vendors

Extended Lifecycle Support

Specialist ELS vendors cover Node.js runtimes as part of their open-source extended support offerings. Multi-year contracts available, typically covering CVSS 7+ vulnerabilities.

View via endoflife.ai →

Feature comparison

Vendor	CVE patching	Compliance docs	Multi-year contracts	Other EOL runtimes
Third-party ELS vendors	✓ CVSS 7+	✓	✓	Linux, PHP, Python

Migrate or extend? How to decide

Choose migration if your Node.js 18 application can be moved to Node.js 22 LTS within 6–12 months without major breaking changes. Node.js 22 is supported until April 2027 and Node.js 24 entered LTS in 2025. Migration eliminates ongoing support costs.

Choose extended support if migration is blocked by: third-party dependency incompatibilities, regulatory change-freeze periods, insufficient engineering bandwidth, or complex monorepos where upgrading the runtime requires months of testing.

ELS is a bridge — not a destination. The right answer is always to establish a migration timeline alongside any extended support contract.

Check your full EOL exposure

See which vendors cover every EOL component in your stack — not just Node.js 18.

Open CVE Intelligence Tool →

What to do about it

Node.js currently carries an EOL Risk Score™ of 55/100 — Grade C, elevated risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the Node.js lifecycle page.

The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.

Guides: Node.js 18 migration guide

Frequently asked questions

Is Node.js 18 still supported?

No. Node.js 18 reached its official end of life on April 30, 2025. It no longer receives security patches, bug fixes, or CVE remediation from the OpenJS Foundation. Organizations still running Node.js 18 in production are exposed to any vulnerability disclosed after that date.

Which vendors offer extended security support for Node.js 18 after end of life?

Several commercial vendors provide extended lifecycle support for Node.js 18: Several vendors provide extended lifecycle support (ELS) for Node.js 18, including options covering ongoing CVE patches, compliance documentation, and multi-year contracts. See the vendor directory for current options.

What are the risks of running Node.js 18 past its EOL date?

Any CVE disclosed after April 30, 2025 will remain permanently unpatched. Vulnerability scanners may stop flagging issues against EOL versions, creating a false sense of security. Compliance frameworks including SOC 2, PCI DSS, and ISO 27001 typically require running supported software.

What version of Node.js should I migrate to?

Node.js 22 is the current Active LTS release, supported until April 2027. Node.js 24 entered LTS in late 2025. Both are valid migration targets — choose based on your ecosystem's compatibility with each version.

How long does extended support for Node.js 18 last?

Duration depends on the vendor. Duration depends on the vendor — options range from 1–3 year contracts to indefinite support while subscription is active. Most organizations pair a 1-year ELS contract with a parallel migration project.

The Monthly EOL Digest™

Once a month — critical EOL dates, CVE blind spots, and lifecycle changes worth knowing about.