Complete Node.js EOL Schedule
Node.js releases even-numbered versions as Long-Term Support (LTS). Odd-numbered versions are short-lived and never reach LTS.
| Version | LTS Start | End of Life | Status | EOL Risk Score™ |
|---|---|---|---|---|
| Node.js 10 | Oct 2018 | Apr 30, 2021 | 🔴 EOL | 95 Critical |
| Node.js 12 | Oct 2019 | Apr 30, 2022 | 🔴 EOL | 92 Critical |
| Node.js 14 | Oct 2020 | Apr 30, 2023 | 🔴 EOL | 90 Critical |
| Node.js 16 | Oct 2021 | Sep 11, 2023 | 🔴 EOL | 90 Critical |
| Node.js 18 | Oct 2022 | Apr 30, 2025 | 🔴 EOL | 85 Critical |
| Node.js 20 | Oct 2023 | Apr 30, 2026 | 🔴 EOL | 78 Critical |
| Node.js 22 | Oct 2024 | Apr 30, 2027 | ✅ Active LTS | 50 Medium |
| Node.js 24 | Oct 2025 | Apr 30, 2028 | ✅ Current | 20 Low |
⚠️ Node.js 20 reached EOL on April 30, 2026. If you're running Node.js 18 or 20 in production today, you're running an unpatched runtime. New CVEs will never receive an official fix for those versions.
Node.js 14 — End of Life April 30, 2023
Node.js 14 entered LTS in October 2020 and reached its official end-of-life date on April 30, 2023. It has now been unsupported for over three years.
Node.js 14 was the last version to ship with OpenSSL 1.1.1, which itself reached end of life in September 2023. Teams still running Node.js 14 are carrying two compounding EOL risks: the runtime and its bundled cryptography library are both unsupported.
Why teams are still on it: dependency lock-in. Node.js 14 was the last version to support certain native addons and older npm packages — node-sass, older bcrypt builds, native modules compiled against Node.js 14's V8 ABI. The migration work is real but manageable.
Migration path:
- Target Node.js 22 directly — skip 16, 18, and 20 which are all EOL
- Replace
node-sasswithsass(pure JS, no native compilation needed) - Run
npx @npmcli/arborist ls --allto audit native dependencies - Check node.green for ES2022+ compatibility gaps
→ Node.js 14 EOL Risk Score Card
Node.js 16 — End of Life September 11, 2023
Here's one most teams didn't see coming: Node.js 16 was cut short by seven months.
Originally scheduled to reach EOL in April 2024, the Node.js Release Working Group accelerated its end-of-life to September 11, 2023 because OpenSSL 1.1.1 — the cryptography library bundled in Node.js 16 — was reaching its own EOL the same month.
Many pipelines that had Node.js 16 pinned assumed they had until mid-2024. The real deadline was six months earlier.
This is exactly why pinning a version without monitoring its lifecycle is dangerous. Vendor timelines change. Sometimes they change in your favour. Sometimes they don't.
→ Node.js 16 EOL Risk Score Card
Node.js 18 — End of Life April 30, 2025
Node.js 18 reached end of life on April 30, 2025 — over a year ago now.
It was widely adopted as the "safe" production version throughout 2023 and 2024. Native fetch(), the first stable node:test module, V8 10.2. Many teams upgraded to 18 for these features and then stayed there.
Key breaking changes moving from Node.js 18 → 22:
-
url.parse()now emits a deprecation warning — migrate tonew URL() -
fs.rmdir(recursive)removed — usefs.rm(path, { recursive: true }) - V8 updated to 12.4 — some native addons may need recompilation
-
--experimental-fetchflag no longer needed —fetchis stable
→ Node.js 18 EOL Risk Score Card
Node.js 20 — End of Life April 30, 2026
Node.js 20 reached end of life on April 30, 2026 — weeks ago.
Teams that were on Node.js 20 thinking they had more runway are now in the same position as Node.js 18 teams were a year ago: running a version that will never receive another security patch.
The upgrade path from 20 to 22 is the shortest and lowest-risk jump in the current release cycle. Most codebases need only dependency updates and a build pipeline change.
If you're running Node.js 20 in production, upgrade to Node.js 22 within 30 days. Start with staging, monitor for 24 hours, promote to production.
→ Node.js 20 EOL Risk Score Card
Node.js 22 — Current LTS, Supported Until April 30, 2027
Node.js 22 is where every production deployment should be today.
It entered LTS in October 2024 and is supported until April 30, 2027. It ships with V8 12.4, a stable node:sqlite module, improved require(esm) support, and native --run for package.json scripts.
Node.js 24 is the current "Current" release for teams that want the latest. It will enter LTS in October 2025 and is supported until April 2028. For most production deployments, Node.js 22 is the right choice today.
→ Node.js 22 EOL Risk Score Card
What the EOL Risk Score™ Means
Every Node.js version page on endoflife.ai carries an EOL Risk Score™ — a 0–100 score measuring the actual security and operational risk of running that version in production.
Four factors:
- EOL Recency (40pts) — how long since the version lost support
- Attack Surface (30pts) — Node.js processes HTTP, executes JS, handles file I/O. CVEs in EOL versions are never patched.
- CISA KEV Exposure (20pts) — whether known exploited vulnerabilities exist in the CISA catalog
- Extended Support Availability (10pts) — whether commercial extended support options reduce urgency
Score reference:
| Version | Score | Band |
|---|---|---|
| Node.js 14 | 90 | 🔴 Critical |
| Node.js 16 | 90 | 🔴 Critical |
| Node.js 18 | 85 | 🔴 Critical |
| Node.js 20 | 78 | 🔴 Critical |
| Node.js 22 | 50 | 🟡 Medium |
| Node.js 24 | 20 | 🟢 Low |
How to Migrate Safely — 5 Steps
Step 1 — Audit dependencies first
Run npm outdated and npm audit before touching your Node.js version. A clean dependency tree makes the runtime upgrade significantly easier.
Step 2 — Check for native addons
Run npm ls --depth=0 and check each package for Node.js 22 compatibility. node-gyp, nan, and napi modules may need recompilation.
Step 3 — Update CI first
Change your CI runner to Node.js 22 before touching production. If your test suite passes on 22, production will follow cleanly. Pin with .nvmrc or .node-version.
Step 4 — Canary deploy
Deploy Node.js 22 to staging with real traffic before full rollout. Monitor error rates, memory, and response times for 24 hours.
Step 5 — Regenerate lockfiles
After upgrading, regenerate package-lock.json or yarn.lock. Some packages resolve differently across Node.js versions.
Check Your Full Stack
Node.js runtime EOL is one piece of the puzzle. Your npm packages, frameworks, and OS runtime each have their own end-of-life dates.
Use the free EOL Checker or Stack Scanner at endoflife.ai to audit your entire dependency tree — no account required.
This article is part of The EOL Intelligence Report series on DEV.to. EOL dates sourced from endoflife.date, Node.js Release Working Group, and CISA KEV Catalog.
Top comments (0)