Node.js Lifecycle Intelligence

Node.js End of Life & Support Options —
What To Do When Node.js Patches Stop, and which version to be on

By Scott Bissett Updated September 5, 2026 · Reference — every Node.js release line · Dates from the Node.js Release Working Group schedule, refreshed nightly

Quick answer: production should be on Node.js 24, the Active LTS (maintenance from October 20, 2026, end of life April 30, 2028). Node.js 22 is in maintenance — critical fixes only — until April 30, 2027. Node.js 20 reached end of life on April 30, 2026; 18, 16 and 14 died in 2025 and 2023. Node.js 26, released May 5, 2026, becomes the next Active LTS on October 28, 2026 and runs to April 30, 2029. Servers on 20 or older receive no security fixes from the Node.js project today.

Key Dates at a Glance

Security notice
Node.js 20 reached end of life on April 30, 2026. If you are running Node.js 20 or anything older in production, you are running an unpatched runtime: CVEs disclosed after the end-of-life date never receive an official fix for those lines. Node.js processes HTTP, parses untrusted input and executes JavaScript — the exposure is real, not theoretical.
Running Node.js past end of life?
Extended support past the official EOL date exists for many products in this position — whether it covers Node.js is exactly what we check. Tell us where to reach you and we’ll reply with matched options and pricing guidance — or an honest “no vendor covers this.” Free, no obligation.

Free · No obligation · Independent — we track the dates, vendors don’t pay for placement · dates verified against vendor sources. See all support options →

Node.js EOL Risk Scores

An end-of-life date on its own does not tell you how urgent a version is. We publish an EOL Risk Score (0–100) for every tracked version, combining how long past — or how close to — end of life it is, the attack surface of the software class, whether CISA lists the product in its Known Exploited Vulnerabilities catalog, and whether commercial extended support exists. Node.js is a high-attack-surface runtime, and third-party extended support exists for its dead lines, which is why the retired versions plateau in the high band rather than critical.

VersionEOL Risk ScoreWhat drives it
Node.js 1670End of life September 11, 2023 — recency factor at maximum; runtime attack surface.
Node.js 1865End of life April 30, 2025.
Node.js 2060End of life April 30, 2026; the recency factor is still climbing.
Node.js 2560Odd-numbered release, end of life June 1, 2026 — dead faster than the LTS before it.
Node.js 2230Maintenance until April 30, 2027; the supported-runtime baseline.
Node.js 2430Active LTS to October 20, 2026, supported to April 30, 2028.
Node.js 2630Current; Active LTS from October 28, 2026, supported to April 30, 2029.

Scores update automatically at every site build as dates pass and the KEV catalog changes; every version, including the odd-numbered lines, is on the Node.js product page, and the methodology is on the EOL Risk Score page.

Complete Node.js Release and End-of-Life Schedule

Every major release line since Node.js 8, from the Node.js Release Working Group schedule. “Active LTS” is when an even-numbered release becomes the recommended production line; “Maintenance” is when it drops to critical fixes only.

VersionReleasedActive LTS fromMaintenance fromEnd of lifeStatus
Node.js 26May 5, 2026Oct 28, 2026Oct 20, 2027Apr 30, 2029Supported
Node.js 25Oct 15, 2025— (odd, no LTS)Apr 1, 2026Jun 1, 2026EOL
Node.js 24May 6, 2025Oct 28, 2025Oct 20, 2026Apr 30, 2028Supported
Node.js 23Oct 16, 2024— (odd, no LTS)Apr 1, 2025Jun 1, 2025EOL
Node.js 22Apr 24, 2024Oct 29, 2024Oct 21, 2025Apr 30, 2027Approaching
Node.js 21Oct 17, 2023— (odd, no LTS)Apr 1, 2024Jun 1, 2024EOL
Node.js 20Apr 18, 2023Oct 24, 2023Oct 22, 2024Apr 30, 2026EOL
Node.js 18Apr 19, 2022Oct 25, 2022Oct 18, 2023Apr 30, 2025EOL
Node.js 16Apr 20, 2021Oct 26, 2021Oct 18, 2022Sep 11, 2023EOL
Node.js 14Apr 21, 2020Oct 27, 2020Oct 19, 2021Apr 30, 2023EOL
Node.js 12Apr 23, 2019Oct 21, 2019Nov 30, 2020Apr 30, 2022EOL
Node.js 10Apr 24, 2018Oct 30, 2018May 19, 2020Apr 30, 2021EOL
Node.js 8May 30, 2017Oct 31, 2017Jan 1, 2019Dec 31, 2019EOL

Every Node.js version, one line each

The same schedule as plain statements, one per release line, for anyone who needs a single date rather than a table. Every date is bound to the same data as the Node.js product page, checked against the Release Working Group's published schedule, and re-verified at each build. Node.js 0.x and 1 to 3 predate the LTS scheme and are not listed.

How the Node.js Release Schedule Works

The exception that proves the rule: Node.js 16 was retired seven months early, on September 11, 2023 instead of April 30, 2024, because the OpenSSL 1.1.1 line it depended on reached end of life. Runtime dates can move when a dependency's date does.

Node.js 26 — Current, Active LTS from October 28, 2026

Released May 5, 2026. It becomes the recommended production line on October 28, 2026, enters maintenance on October 27, 2027 and reaches end of life on April 30, 2029. Until October it is a “Current” release: fine for development and CI, not the default for long-lived production workloads.

Node.js 24 — Active LTS, End of Life April 30, 2028

Released May 6, 2025; Active LTS since October 28, 2025; maintenance from October 20, 2026; end of life April 30, 2028. This is the version to be on today, and the target for every migration below.

Node.js 22 — Maintenance, End of Life April 30, 2027

Released April 24, 2024; Active LTS from October 29, 2024; maintenance since October 21, 2025; end of life April 30, 2027. Still safe — it gets critical security fixes — but no longer the line new work should target. Teams on 22 have until April 2027; the 22 → 24 hop is small.

Node.js 20 — End of Life April 30, 2026

Released April 18, 2023; Active LTS from October 24, 2023; maintenance from October 22, 2024; end of life April 30, 2026. Unpatched since then. Node.js 20 was the last line many frameworks and serverless runtimes defaulted to through 2024, so it is the most common surprise in inventories today; the AWS Lambda runtime deprecation schedule covers what happens to nodejs20.x functions.

Node.js 18, 16 and 14 — Long Past End of Life

Node.js 18 died April 30, 2025; 16 on September 11, 2023 (early, for OpenSSL 1.1.1); 14 on April 30, 2023. Anything on these lines is years behind on security fixes and usually pinned there by a framework or native module that has itself gone end of life. The dedicated pieces: Node.js 18 migration guide, Node.js 18 extended-support vendors, Node.js 14 end of life.

How to Check Your Node.js Version

Fleet-wide, the same value comes from your CMDB or agent inventory; the EOL Checker takes a version and returns status and dates, and the Stack Scanner reads a package.json or lockfile and flags the runtime alongside the frameworks that pin it.

What Happens When a Node.js Version Reaches End of Life

The process keeps running — and every vulnerability disclosed afterwards stays open on it. Node.js sits in front of untrusted input by design, so runtime CVEs (HTTP request smuggling, header parsing, permission bypasses, OpenSSL issues bundled into the binary) are directly reachable. Vulnerability scanners often miss it because they check CVE version ranges that do not enumerate the end-of-life build — the CVE blind spot. Compliance frameworks (PCI DSS, SOC 2, ISO 27001, NIS2) treat an unsupported runtime as a control failure.

Your Options on an End-of-Life Node.js Version

How to Migrate to Node.js 24 Safely

The fastest path from any end-of-life Node.js version to Node.js 24 follows the same pattern regardless of your starting point:

Step 1 — Audit your dependencies

Run npm outdated and npm audit before touching your Node.js version. Resolve dependency issues first — a clean dependency tree makes the runtime upgrade significantly easier.

Step 2 — Check for native addons

Native addons compiled against older Node.js ABIs (node-gyp, nan, N-API) may need recompilation or replacement. Run npm ls --depth=0 and check each package against its Node.js 24 compatibility status.

Step 3 — Update your CI pipeline first

Change your CI runner to Node.js 24 before updating production. If your test suite passes on 24, production will follow cleanly. Use .nvmrc or .node-version to pin the version explicitly.

Step 4 — Canary the runtime

Deploy Node.js 24 to a canary or staging environment carrying real traffic before full rollout. Monitor error rates, memory usage and response times for 24 hours before promoting to production.

Step 5 — Update your lockfiles

After upgrading Node.js, regenerate package-lock.json or yarn.lock with the new engine. Some packages resolve differently across Node.js versions.

What to do about it

Node.js currently carries an EOL Risk Score™ of 60/100 — Grade C, elevated risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the Node.js lifecycle page.

The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.

Guides: Node.js 18 migration guide

Frequently Asked Questions

Which Node.js versions are supported right now?

Node.js 24 (Active LTS until October 20, 2026, then maintenance until April 30, 2028), Node.js 22 (maintenance until April 30, 2027) and Node.js 26 (Current; it becomes Active LTS on October 28, 2026 and runs to April 30, 2029). Node.js 25, the odd-numbered release, ended June 1, 2026. Everything 20 and below is end of life.

Is Node.js 20 still supported?

No. Node.js 20 reached end of life on April 30, 2026. It receives no security fixes from the Node.js project. Move to Node.js 24 (Active LTS) — or 22 if a dependency blocks 24 — or buy third-party extended support if the application genuinely cannot move yet.

Is Node.js 18 still supported?

No. Node.js 18 reached end of life on April 30, 2025 and Node.js 16 on September 11, 2023 (cut short from April 2024 because OpenSSL 1.1.1 went end of life). Both are unpatched. Third-party vendors sell security patches for Node.js 16 and 18 for teams that cannot upgrade.

When does Node.js 22 reach end of life?

April 30, 2027. Node.js 22 was released April 24, 2024, became Active LTS on October 29, 2024, and entered maintenance (critical fixes only) on October 21, 2025. Plan to be on 24 before April 2027.

When does Node.js 24 reach end of life?

April 30, 2028. Node.js 24 was released May 6, 2025, became Active LTS on October 28, 2025, enters maintenance on October 20, 2026, and is supported until April 30, 2028. It is the version production should be on today.

How does the Node.js release schedule work?

A new major ships every April (even-numbered) and October (odd-numbered). Even-numbered releases become Active LTS in October of their release year, get 12 months of Active LTS, then 18 months of maintenance — about 30 months of support in total, always ending on April 30. Odd-numbered releases are Current for six months and then get roughly two months of maintenance; they never become LTS and should not run in production.

How do I check my Node.js version?

Run node -v (or node --version) on the host, or read process.version inside the application. Check what your project pins in .nvmrc, .node-version, the engines field of package.json, and your Dockerfile's FROM node:… tag — the pinned version is often older than the host's. In containers, docker run --rm <image> node -v.

What should I do if I am on an end-of-life Node.js version?

Upgrade to Node.js 24, the Active LTS, following the steps below (audit dependencies, check native addons, move CI first, canary, regenerate lockfiles). If a framework or native module pins you to 16, 18 or 20, third-party extended support can buy time — a bridge, not a destination — and the vendors are compared on our extended support page.

When does Node.js 26 become LTS, and when does it reach end of life?

Node.js 26 shipped May 5, 2026 as a Current release, enters Active LTS on October 28, 2026, moves to maintenance on October 20, 2027 and reaches end of life on April 30, 2029. Until October it is the release to test against, not the one to run in production; Node.js 24 is the production line today.

Is Node.js 16 still supported?

No. Node.js 16 reached end of life on September 11, 2023, Node.js 14 on April 30, 2023 and Node.js 12 on April 30, 2022. Anything on those lines has had no security fixes for years. Node.js 18 followed on April 30, 2025 and Node.js 20 on April 30, 2026.

What changes with Node.js 27?

The Node.js project has announced that, starting with Node.js 27, the release cycle becomes annual and every major version moves to long-term support, ending the even-only LTS convention that has held since Node.js 4. Node.js 27 has no published dates yet; when the Release Working Group publishes its schedule the line will appear on this page and on the Node.js product page.

Is there extended support for Node.js 18 or 20 after end of life?

Not from the Node.js project, whose support ends on the end-of-life date. Commercial vendors sell security patches for end-of-life Node.js lines, usually priced per year, as a bridge for applications that cannot move to a supported release in time. Whether a bridge beats an upgrade depends on how long the application has left to run; the form on this page matches options.

Check your full stack
Node.js runtime EOL is one piece of the puzzle. Your npm packages, frameworks, and OS runtime each have their own end-of-life dates. Use the EOL Checker or Stack Scanner to audit your entire dependency tree at once.

The Monthly EOL Digest™

Once a month — critical end-of-life dates, CVE blind spots, and lifecycle changes worth knowing about.

✓ You're on the list.
© 2026 endoflife.ai — Software Lifecycle Intelligence Data: endoflife.date · MIT License