Node.js 18 end of life
Node.js 18 reached end of life on 30 April 2025. It entered Long Term Support in October 2022 and ran the standard 30-month LTS window. The final release was 18.20.8. The Node.js project publishes no further security releases on the 18.x line.
- End of life
- 30 April 2025
- Released
- Apr 2022
- Final release
- 18.20.8
- Successor
- Node.js 22 or 24 (both Active LTS lines)
Date published by Node.js release schedule. We do not publish a lifecycle date we cannot source.
What actually stops on 30 April 2025
- Security releases on the 18.x line, including fixes to the bundled OpenSSL and to undici, the HTTP client built into the runtime.
- Official Node.js Docker images for 18 stop being rebuilt, so the base OS layer accumulates its own CVEs independently of Node.
- npm and V8 updates shipped with the runtime.
What actually breaks in the upgrade
The bundled OpenSSL is the exposure people miss
Node bundles its own OpenSSL. An unpatched Node 18 therefore carries an unpatched TLS stack regardless of what the host OS has installed, and that is not visible to an OS-level package scanner. This is consistently the most under-appreciated part of running end-of-life Node.
18 to 22 is usually undramatic
For most applications the runtime upgrade is a CI matrix change and a dependency audit. Native modules are the exception: anything compiled against the Node 18 ABI needs rebuilding, and packages that have gone unmaintained are where the work lands.
Rebuild the image even if you defer the runtime
Because the official Node 18 images stopped being rebuilt, a large share of the CVEs in a Node 18 image scan are Debian or Alpine package CVEs rather than Node ones. Rebuilding on a maintained base clears most of the scan noise and is cheaper than a runtime upgrade.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Node 22 or 24 | Usually a CI matrix change plus a native-module rebuild. | Days for most applications | Engineering time | The right answer, and the cheapest upgrade on this list for most teams. |
| Extended support on Node 18 | Backported CVE fixes to 18.x including the bundled OpenSSL, plus rebuilt images. | Days | Subscription | Right when a native dependency or a vendor product pins the runtime. |
| Stay unpatched | An unpatched bundled TLS stack plus an unrebuilt base image. | None | Zero now | The bundled OpenSSL makes this worse than it looks from an OS-level scan. |
What OSSeva does for Node.js 18
OSSeva patches this line
OSSeva backports CVE fixes to Node.js 18 including the bundled OpenSSL and undici, and rebuilds the container images so the base layer is current. For most teams we will recommend upgrading to 22 instead, because the Node upgrade path is genuinely one of the easier ones.
Node.js extended supportWhat your auditor will say
Requirement 6.3.3. The bundled OpenSSL matters here: an assessor looking only at OS packages will miss it, but a thorough one will not.
CC7.1, and the image-layer CVEs will appear in whatever container scanning evidence you provide.
Node.js 18: common questions
When did Node.js 18 reach end of life?
30 April 2025, at the end of its 30-month Long Term Support window. The final release was 18.20.8.
Is Node.js 18 still supported?
No. The Node.js project publishes no further security releases on the 18.x line, and the official Docker images for 18 are no longer rebuilt.
Is it safe to keep running Node.js 18?
The under-appreciated risk is that Node bundles its own OpenSSL, so an unpatched Node 18 carries an unpatched TLS stack that an OS-level package scan will not show. That is a different exposure from a normal unpatched application dependency.
What should I upgrade Node.js 18 to?
Node.js 22 or 24, both Active LTS lines. For most applications this is a CI matrix change plus a rebuild of any native modules compiled against the Node 18 ABI.
Why does my Node 18 image show so many vulnerabilities?
Most are not Node CVEs. The official Node 18 images stopped being rebuilt, so the Debian or Alpine packages beneath your application have had no OS-level fixes since the date. Rebuilding on a maintained base clears the majority.
Can I get security patches for Node.js 18?
Yes, from a third-party provider. OSSeva backports fixes to 18.x including the bundled OpenSSL and undici, and rebuilds the images — though upgrading to 22 is usually cheaper and we will tell you so.
Still running Node.js 18?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.