Node.js Version Support: EOL Dates and Latest Releases (July 2026)

A complete reference for every Node.js release timeline, the CVEs hitting end-of-life versions, and what your options are once official support stops.

‍

Node.js powers a huge share of the modern backend: it runs on millions of production servers, underpins the tooling for nearly every frontend framework, and is a core dependency in enterprise stacks across finance, healthcare, and government. It also ships on a strict, predictable schedule. A new major lands roughly every six months, even-numbered releases graduate to Long-Term Support (LTS), and every release eventually hits a hard end-of-life (EOL) date after which the Node.js project ships no further patches of any kind.

That cadence is a gift for planning and a liability for teams that fall behind. Once a version reaches EOL, newly disclosed CVEs against it go unpatched in the official distribution, and your SCA scanners start flagging the runtime itself as a vulnerability with no fix path. As of mid-2026, Node.js 18 and everything below it are end-of-life, and Node.js 20 reached EOL on April 30, 2026.

This guide is the definitive reference for every Node.js release, its support timeline, the security exposure on EOL versions, and what to do about it. HeroDevs is a founding partner in the OpenJS Foundation's Ecosystem Sustainability Program (ESP) and a Gold Member of the OpenJS Foundation, and provides Never-Ending Support (NES) for Node.js for versions past their official EOL.

‍

How Node.js's Release and Support Policy Works

Every Node.js major version moves through a fixed set of phases:

• Current (6 months): The active development line. New features, APIs, and improvements land here. Both even and odd majors start as Current.
• Active LTS (12 months): Even-numbered releases only. Focus shifts to stability. The release receives bug fixes, security patches, and select non-breaking improvements.
• Maintenance LTS (roughly 12 months): Critical bug fixes and security patches only. No new features.
• End of Life: No further updates of any kind. No security patches, no fixes, no support.

Odd-numbered releases (19, 21, 23, 25) never enter LTS. They stay Current for six months and then go straight to EOL, which is why they are unsuitable for production. Even-numbered releases (18, 20, 22, 24, 26) get the full LTS treatment and roughly three years of total support from initial release to EOL. For any system you intend to run longer than a quarter, an even-numbered LTS line is the only sensible choice.

‍

Complete Node.js Version Timeline

The table below covers every major line from Node.js 8 through 26. Dates reflect the official Node.js release schedule as of June 2026.

The only fully supported lines today are Node.js 26 (Current), 24 (Active LTS), and 22 (Maintenance LTS). Everything else is end-of-life.

‍

Versions Reaching EOL Next: What to Watch

Node.js 20 End of Life

Node.js 20 reached end-of-life on April 30, 2026. It was one of the most widely deployed LTS lines in Node's history, which means a large installed base is now running an unsupported runtime.

Several high-impact CVEs have landed against the 20 line, and any disclosed after the EOL date will not be patched upstream:

• CVE-2025-23166 (High): The C++ method SignTraits::DeriveBits() can incorrectly call ThrowException() on user-supplied input when running in a background thread, crashing the Node.js process. Because these cryptographic operations are routinely applied to untrusted input, this is a remotely triggerable denial-of-service. Fixed in 20.19.1; later 20.x releases are unaffected, but EOL deployments pinned below that will not receive the fix going forward.
• CVE-2025-23167 (Medium): A flaw in the Node.js 20 HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of \r\n\r\n, enabling request smuggling and proxy access-control bypass. Fixed in 20.19.1.
• CVE-2025-27210 (High): An incomplete fix for CVE-2025-23084 affecting Windows device names like CON, PRN, and AUX, exposing a path traversal in the path.join API on Windows. Fixed in 20.19.4.

Node.js 18 End of Life

Node.js 18 reached end-of-life on April 30, 2025. It is past EOL but remains extremely common in production, and it is consistently one of the most-searched Node versions, which tells you how many teams are still standardized on it.

Notable CVEs affecting the 18 line include:

• CVE-2025-23166 (High): The same SignTraits::DeriveBits() crash described above. Fixed in the 18.20.x maintenance line, but no fixes ship to 18 after EOL.
• CVE-2025-23084 (Medium): A path traversal in path.join on Windows device names. Fixed in 18.20.6.
• CVE-2025-23085 (Medium): A memory leak in the HTTP/2 implementation enabling denial-of-service. Fixed in 18.20.6.
• CVE-2024-27980 (High): A command injection on Windows via crafted arguments to child_process.spawn / spawnSync. Fixed in 18.20.2.

Any vulnerability disclosed against 18 after April 30, 2025 receives no official patch. The runtime is now a standing finding in any compliance-driven security scan.

Node.js 22: The Current LTS Anchor

Node.js 22 is in Maintenance LTS and reaches EOL on April 30, 2027. Teams on EOL versions that want the longest runway with the least disruption should evaluate 22 (Maintenance LTS) or 24 (Active LTS, EOL April 30, 2028) as upgrade targets. Note that Node.js 22 still actively receives CVE fixes, for example CVE-2026-21717 (DoS, fixed in 22.22.2), which is a reminder that even supported lines need continuous patching.

‍

What Happens After End of Life

When a Node.js version reaches EOL, three things happen, all of them bad for production systems:

1. Security patches stop. This is the headline risk. CVEs disclosed against the V8 engine, the HTTP/HTTP2 parsers, the crypto subsystem, and the dependency surface (OpenSSL, llhttp, c-ares) continue to surface, but the Node.js project no longer backports fixes to EOL lines. CVE-2025-23166, CVE-2025-23167, and CVE-2025-27210 are recent examples that landed around the 20 EOL window.
2. Compatibility degrades. Newer native modules, npm packages, and toolchains increasingly drop support for old Node majors. node-gyp builds break against newer compilers, and modern dependency versions start requiring runtime features your EOL version does not have. The result is a slow squeeze where you can neither upgrade dependencies nor stay put safely.
3. Compliance audits flag it. SOC 2, PCI DSS, HIPAA, FedRAMP, NIS2, DORA, and the EU Cyber Resilience Act all require running supported software with a security patch path. An EOL runtime is a direct finding. Software composition analysis tools now explicitly flag end-of-life runtimes as vulnerabilities in their own right, separate from any individual CVE.

‍

Options for EOL Node.js Versions

If you are running Node.js 20 or earlier, you have three realistic paths.

1. Upgrade to a Supported LTS Version

The best long-term answer for most teams. Move to Node.js 22 (Maintenance LTS) or 24 (Active LTS). Check native dependencies and node-gyp build targets, run your full test suite against the new runtime in staging, and watch for behavioral changes in the V8 and stream APIs. The cost is engineering time and regression risk, which scales with how far behind you are and how many native modules you depend on.

2. Migrate Off Node.js

A small number of teams use an EOL event as the trigger for a larger platform change (for example, moving services to a different runtime such as Deno or Bun, or rewriting in another language). This is the most expensive and disruptive option and is rarely justified by the EOL alone.

3. Adopt Never-Ending Support (NES)

HeroDevs Never-Ending Support (NES) for Node.js provides drop-in security patches for Node.js 12, 14, 16, 18, and 20 after their official EOL. This is the path for teams that cannot upgrade on the project's timeline but still need to stay secure and compliant.

HeroDevs is a founding partner in the OpenJS Foundation's Ecosystem Sustainability Program and a Gold Member of the OpenJS Foundation, working directly within the official program that the Node.js project points to for commercial post-EOL support. NES delivers:

• Continuous CVE remediation. A new NES release each time a relevant CVE is found, validated, and fixed for your version, not a one-time backport. HeroDevs has remediated more than 20 CVEs across EOL Node.js lines, with same-day response on critical issues.
• Drop-in compatibility. Point your package manager at the NES registry and rebuild. No code changes, no migrations, no find-and-replace. Works with nvm, AWS Lambda, GitHub Actions, RPM, Artifactory, and Nexus across Linux, macOS, Windows, and RHEL 8.
• Compliance SLAs. Patch-delivery SLAs designed to keep you compliant with SOC 2, NIS2, PCI DSS, HIPAA, DORA, and CRA.

NES picks up the day official Node.js support ends, with no gap in coverage.

‍

Quick Reference: Is My Node.js Version Supported?

‍

Frequently Asked Questions

When does Node.js 20 reach end of life?

Node.js 20 reached end-of-life on April 30, 2026. After that date, the Node.js project no longer ships security patches or fixes for the 20 line.

When did Node.js 18 reach end of life?

Node.js 18 reached end-of-life on April 30, 2025. It no longer receives official updates of any kind, including security patches.

Is Node.js 18 still safe to use in production?

Not without a security patch path. Node.js 18 is past EOL, so newly disclosed CVEs against it go unpatched upstream, and most compliance frameworks will flag the runtime itself. Either upgrade to a supported LTS line or adopt Never-Ending Support to keep receiving patches.

What is the latest Node.js LTS version?

Node.js 24 is the Active LTS line (EOL April 30, 2028) and Node.js 22 is in Maintenance LTS (EOL April 30, 2027). Node.js 26, released in May 2026, is the Current line and is scheduled to enter LTS in October 2026.

Why should I avoid odd-numbered Node.js versions in production?

Odd-numbered releases (19, 21, 23, 25) never enter LTS. They stay Current for six months and then go straight to EOL, so they receive no long-term security support. Use even-numbered LTS lines for production.

Does HeroDevs support end-of-life Node.js versions?

Yes. HeroDevs provides Never-Ending Support (NES) for Node.js 12, 14, 16, 18, and 20, delivering drop-in security patches after official EOL. HeroDevs is a founding partner in the OpenJS Foundation's Ecosystem Sustainability Program and a Gold Member of the OpenJS Foundation.

‍

Next Steps

Node.js's six-month release cadence and roughly three-year support window mean staying current is a continuous commitment, not a one-time upgrade. With Node.js 18 and 20 both now end-of-life, a large share of production deployments are running unsupported runtimes while CVEs continue to surface against them.

Whether you upgrade to a supported LTS line or adopt extended support, the worst option is doing nothing. If your organization is running an end-of-life version of Node.js, explore HeroDevs Never-Ending Support for Node.js or contact HeroDevs to talk through your options.