Node.js 14 end of life
Node.js 14 reached end of life on 30 April 2023. The last release was v14.21.3, published on 16 February 2023, so no Node.js security fix has reached the 14.x line since then. It bundles OpenSSL 1.1.1t and npm 6.14.18, and OpenSSL 1.1.1 itself left support in September 2023. OSSeva ships patched Node.js 14 runtimes for services still pinned to it.
- End of life
- 30 April 2023
- Released
- Apr 2020
- Final release
- 14.21.3
- Successor
- Node.js 22 or 24 LTS
Date published by Node.js release schedule. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 30 April 2023
- Security releases on the 14.x line. v14.21.3 was the last.
- Fixes for the bundled OpenSSL 1.1.1t. OpenSSL 1.1.1 left upstream support on 11 September 2023.
- Updates to the bundled V8 8.4 engine and npm 6.14.18.
What actually breaks in the upgrade
Several major lines in one move
Leaving 14 for a supported line crosses at least four majors of V8, libuv and npm at once. Most application code survives. The build chain, the lockfiles and the native add-ons are where the time goes.
OpenSSL 3 arrives on the way
Node.js 17 and later build against OpenSSL 3. Tooling that relies on algorithms OpenSSL 3 no longer enables by default can fail with ERR_OSSL_EVP_UNSUPPORTED, so test the build as well as the runtime.
Go to Node.js 24
Node.js 22 reaches end of life on 30 April 2027 and Node.js 24 on 30 April 2028. From 14, the extra step to 24 costs little and buys a year.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Node.js 24 | Rebuild native modules, update the build chain, retest. | Weeks to months | Engineering time | The destination. Supported to April 2028. |
| OSSeva patched Node.js 14 | Signed 14.x runtimes with backported security fixes. | Days | Subscription | For services held on 14 by native modules, vendor certification or a frozen codebase. |
| Stay unpatched | No fixes since February 2023. | None | Zero now | More than three years of open advisories on an internet-facing runtime. |
What OSSeva does for Node.js 14
OSSeva patches this line
OSSeva ships patched Node.js 14 runtimes now, with security fixes backported to the 14.x line, on the Patch, Assure and Operate tiers.
Node.js extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A runtime or broker with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Node.js 14: common questions
When did Node.js 14 reach end of life?
On 30 April 2023. The last release was v14.21.3, on 16 February 2023.
Which OpenSSL does Node.js 14 use?
The final release, v14.21.3, bundles OpenSSL 1.1.1t. OpenSSL 1.1.1 reached end of support on 11 September 2023.
What should I upgrade Node.js 14 to?
Node.js 24, supported until 30 April 2028. Node.js 22 ends on 30 April 2027.
Can I get security patches for Node.js 14?
Not from the Node.js project. OSSeva ships patched Node.js 14 runtimes today.
Still running Node.js 14?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.