Node.js 18 end of life
Node.js 18 reached end of life on 30 April 2025. It entered Long Term Support in October 2022 and ran the standard 30-month LTS window. The final release was 18.20.8. The Node.js project publishes no further security releases on the 18.x line.
What now
Which vendors provide Node.js 18 security patches now that support has ended?
Node.js 18 Extended Support, and Node.js 20 End of Life- End of life
- 30 April 2025
- Released
- Apr 2022
- Final release
- 18.20.8
- Successor
- Node.js 24 or 26 LTS (22 ends 30 April 2027)
Date published by Node.js release schedule. We do not publish a lifecycle date we cannot source. Dates checked on endoflife.date and the Node.js release schedule on 20 October 2026.
Last reviewed
Node.js versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Node.js 24 | 6 May 2025 | 30 April 2028 | Approaching |
| Node.js 22 | 24 Apr 2024 | 30 April 2027 | Approaching |
| Node.js 20 | 18 Apr 2023 | 30 April 2026 | End of life |
| Node.js 18 (this page) | 19 Apr 2022 | 30 April 2025 | End of life |
| Node.js 16 | 20 Apr 2021 | 11 September 2023 | End of life |
| Node.js 14 | 21 Apr 2020 | 30 April 2023 | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 30 April 2025
- Security releases on the 18.x line, including fixes to the bundled OpenSSL and to undici, the HTTP client built into the runtime.
- Official Node.js Docker images for 18 stop being rebuilt, so the base OS layer accumulates its own CVEs independently of Node.
- npm and V8 updates shipped with the runtime.
What actually breaks in the upgrade
The bundled OpenSSL is the exposure people miss
Node bundles its own OpenSSL. An unpatched Node 18 therefore carries an unpatched TLS stack regardless of what the host OS has installed, and that is not visible to an OS-level package scanner. This is consistently the most under-appreciated part of running end-of-life Node.
The runtime upgrade is usually undramatic
For most applications the runtime upgrade is a CI matrix change and a dependency audit. Native modules are the exception: anything compiled against the Node 18 ABI needs rebuilding, and packages that have gone unmaintained are where the work lands.
Rebuild the image even if you defer the runtime
Because the official Node 18 images stopped being rebuilt, a large share of the CVEs in a Node 18 image scan are Debian or Alpine package CVEs rather than Node ones. Rebuilding on a maintained base clears most of the scan noise and is cheaper than a runtime upgrade.
Security releases since Node.js 18 ended
Node.js 18 reached end of life on 30 April 2025. This table lists every Node.js security release since then and the CVEs in OSSeva's CVE directory that each one fixed.
Six Node.js security releases have shipped since 30 Apr 2025 and none included 18.x. The CVE directory lists 12 CVEs scored 7.0 or higher that those releases fixed. Counts as of 20 October 2026.
Node.js security releases since 30 Apr 2025, with the CVEs in the OSSeva CVE directory
| Release | Lines patched | Missed by | CVE | CVSS | Issue |
|---|---|---|---|---|---|
| 14 May 2025 | 20, 22, 23, 24 | 18 | CVE-2025-23166 | 7.5 | error handling in async cryptographic operations crashes the process |
| 15 Jul 2025 | 20, 22, 24 | 18 | CVE-2025-27210 | 7.5 | Windows device names bypass path traversal protection |
| 12 Jan 2026 | 20, 22, 24, 25 | 18 | CVE-2025-55130 | 9.1 | permission model bypass using crafted symlinks |
| 12 Jan 2026 | 20, 22, 24, 25 | 18 | CVE-2025-55131 | 7.1 | Buffer.alloc can return memory that is not zero-filled |
| 12 Jan 2026 | 20, 22, 24, 25 | 18 | CVE-2025-59465 | 7.5 | malformed HTTP/2 HEADERS frame crashes the process |
| 12 Jan 2026 | 20, 22, 24, 25 | 18 | CVE-2025-59466 | 7.5 | stack overflow errors become uncatchable with async_hooks |
| 12 Jan 2026 | 20, 22, 24, 25 | 18 | CVE-2026-21637 | 7.5 | exceptions in TLS PSK, ALPN and SNI callbacks crash the server |
| 24 Mar 2026 | 20, 22, 24, 25 | 18 | CVE-2026-21710 | 7.5 | __proto__ header name crashes servers that read req.headersDistinct |
| 17 Jun 2026 | 22, 24, 26 | 18 and 20 | CVE-2026-48933 | 7.5 | WebCrypto AES integer overflow crashes the process |
| 28 Jul 2026 | 22, 24, 26 | 18 and 20 | CVE-2026-56846 | 7.5 | retained HTTP/2 headers bypass maxSessionMemory |
| 28 Jul 2026 | 22, 24, 26 | 18 and 20 | CVE-2026-56848 | 7.5 | HTTP/2 re-entrant send causes heap use-after-free |
| 28 Jul 2026 | 22, 24, 26 | 18 and 20 | CVE-2026-58043 | 8.4 | permission model path matching over-grants file system access |
Release dates are from nodejs.org/dist/index.json and the lines patched from the Node.js security announcements. The directory lists Node.js CVEs matched at NVD to the product with a CVSS score of 7.0 or higher, so it is a subset of what each release fixed. The Node.js project does not assess ended lines: each announcement says end-of-life versions are always affected, so a scanner that follows those advisories can flag these CVEs against an ended line even though no fixed version of it exists.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Node 24 or 26 | Usually a CI matrix change plus a native-module rebuild. | Scales with native modules, deprecated APIs and test coverage | Engineering time | The right answer for most teams. 24 is supported to April 2028 and 26 to April 2029. |
| Extended support on Node 18 | Backported CVE fixes to 18.x including the bundled OpenSSL, plus rebuilt images: Critical within 48 hours, High within 7 days. | Starts from your current version | Subscription, priced per application runtime | Right when a native dependency or a vendor product pins the runtime. |
| Stay unpatched | An unpatched bundled TLS stack plus an unrebuilt base image. | None | Zero now | The bundled OpenSSL makes this worse than it looks from an OS-level scan. |
What OSSeva does for Node.js 18
OSSeva patches this line
OSSeva backports CVE fixes to Node.js 18 including the bundled OpenSSL and undici, and rebuilds the container images so the base layer is current. For most teams we will recommend upgrading to 22 instead, because the Node upgrade path is genuinely one of the easier ones.
Node.js extended supportWhat your auditor will say
Requirement 6.3.3. The bundled OpenSSL matters here: an assessor looking only at OS packages will miss it, but a thorough one will not.
CC7.1, and the image-layer CVEs will appear in whatever container scanning evidence you provide.
When did Node.js 18 reach end of life?
30 April 2025, at the end of its 30-month Long Term Support window. The final release was 18.20.8.
Is Node.js 18 still supported?
No. The Node.js project publishes no further security releases on the 18.x line, and the official Docker images for 18 are no longer rebuilt.
Is it safe to keep running Node.js 18?
The under-appreciated risk is that Node bundles its own OpenSSL, so an unpatched Node 18 carries an unpatched TLS stack that an OS-level package scan will not show. That is a different exposure from a normal unpatched application dependency.
What should I upgrade Node.js 18 to?
Node.js 24, supported to 30 April 2028, or Node.js 26, which becomes LTS on 28 October 2026 and is supported to 30 April 2029. Node.js 22 ends on 30 April 2027, so it is a short stop. For most applications this is a CI matrix change plus a rebuild of any native modules compiled against the Node 18 ABI.
Which security releases has Node.js 18 missed?
6 since 30 April 2025, from May 2025 to July 2026, and none included 18.x. The table above lists the 12 CVEs in OSSeva's CVE directory that they fixed.
Why does my Node 18 image show so many vulnerabilities?
Most are not Node CVEs. The official Node 18 images stopped being rebuilt, so the Debian or Alpine packages beneath your application have had no OS-level fixes since the date. Rebuilding on a maintained base clears the majority.
Can I get security patches for Node.js 18?
Yes, from a third-party provider. OSSeva backports fixes to 18.x including the bundled OpenSSL and undici, and rebuilds the images, though upgrading is usually cheaper and we will tell you so.
Get a quote
Still running Node.js 18?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?