Node.js 20 end of life
Node.js 20 reached end of life on 30 April 2026. The last release on the line was v20.20.2, published on 24 March 2026. Since then the June and July 2026 security releases fixed 23 CVEs in Node.js 22, 24 and 26 and shipped nothing for 20.x, so those vulnerabilities stay open on Node 20 unless you upgrade or use extended security support.
- End of life
- 30 April 2026
- Released
- Apr 2023
- Final release
- 20.20.2
- Successor
- Node.js 22 or 24 LTS
Date published by Node.js release schedule. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 30 April 2026
- Security releases on the 20.x line. v20.20.2 was the last, and the June and July 2026 security releases patched only 22, 24 and 26.
- Updates to the bundled OpenSSL, V8, libuv and npm for the 20.x line. v20.20.2 bundles OpenSSL 3.0.19, and the OpenSSL project no longer supports the 3.0 series; Node.js 22.23.2 and 24.18.1 bundle OpenSSL 3.5.7.
- Official Docker image and distribution package updates for Node.js 20.
- Triage of new reports against 20.x. Each Node.js security announcement states that end-of-life versions are always affected when a security release occurs.
What actually breaks in the upgrade
What changed after 30 April 2026
Two security releases have shipped since Node.js 20 reached end of life, and neither included 20.x. The June 2026 release (22.23.0, 24.17.0 and 26.3.1) fixed 12 CVEs, two of them High: CVE-2026-48933, an integer overflow in WebCrypto AES that aborts the process, and CVE-2026-48618, a hostname normalisation mismatch that can bypass TLS wildcard checks. The July 2026 release (22.23.2, 24.18.1 and 26.5.1) fixed 11 CVEs, three of them High: CVE-2026-56846 and CVE-2026-56848 in HTTP/2, the second a heap use-after-free, and CVE-2026-58043, a permission model path check that over-grants file system access.
Scanners keep flagging 20.x
Because the project treats end-of-life lines as affected by every new security release, vulnerability scanners that follow those advisories report new Node.js CVEs against 20.x, with no fixed 20.x version to point to. Every quarter on Node 20 adds findings that can only be closed by an upgrade, a backported fix or a documented exception.
Native modules decide the date
Most JavaScript runs unchanged on Node.js 22. Native add-ons are compiled for one ABI version: 115 on Node.js 20, 127 on 22 and 137 on 24. Each must be rebuilt for the new line, and some older add-ons no longer build at all. Inventory them, with npm ls and a search for binding.gyp, before you schedule the upgrade.
Upgrading from 20 to 22
Node.js 22 moves V8 from 11.3 to 12.4, enables the global WebSocket client by default, raises the default stream highWaterMark, and runtime-deprecates calling the crypto Hash and Hmac constructors directly in favour of createHash and createHmac. From 22.12.0, require() can load ES modules without a flag, which changes how some mixed CommonJS and ESM packages resolve. Run the test suite with deprecation warnings visible before you switch production.
Upgrading from 20 to 24
Node.js 24 adds V8 13.6 and npm 11. It removes tls.createSecurePair, runtime-deprecates url.parse() and SlowBuffer, renames the permission model flag from --experimental-permission to --permission, and switches AsyncLocalStorage to AsyncContextFrame. Applications that rely on url.parse() or on unusual async context propagation need the most testing. Going straight to 24 avoids a second upgrade within a year.
Node.js 22 is not the long runway
Node.js 22 reaches end of life on 30 April 2027. Node.js 24 is supported until 30 April 2028, and Node.js 26 becomes LTS on 28 October 2026 with support until 30 April 2029. Teams upgrading now should go to 24 so they do not repeat the exercise in a year.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Node.js 24 | Rebuild native modules, clear url.parse() and other deprecations, retest. | Days to weeks | Engineering time | The default destination. Supported until April 2028. |
| Upgrade to Node.js 22 | The smaller step from 20, with fewer removed APIs. | Days | Engineering time | Only as an interim step. End of life on 30 April 2027. |
| Extended security support | Backported fixes for Node.js 20 runtimes. | Days | Subscription | For applications pinned by native modules, vendor certification or a release freeze. |
| Stay unpatched | No fixes since March 2026, with two security releases already missed. | None | Zero now | Node.js services are usually internet-facing. A poor place to carry risk. |
What OSSeva does for Node.js 20
OSSeva patches this line
OSSeva backports security fixes to Node.js 16, 18 and 20 runtimes, including fixes from each Node.js security release where the affected code exists on the 20.x line, and helps plan the move to a current LTS line.
Node.js extended supportWhat your auditor will say
Requirement 6.3.3. Payment pages and APIs on an unsupported runtime need patched components or a documented compensating control.
CC7.1. Auditors look for evidence that production runtimes receive security fixes.
Node.js 20: common questions
When did Node.js 20 reach end of life?
On 30 April 2026. The last release was v20.20.2 on 24 March 2026.
Is Node.js 20 still safe to use?
Not without extra cover. The June and July 2026 security releases fixed 23 CVEs, five of them rated High, in Node.js 22, 24 and 26 only. Node.js 20 received none of those fixes.
Which security releases has Node.js 20 missed?
The June 2026 release (22.23.0, 24.17.0, 26.3.1) and the July 2026 release (22.23.2, 24.18.1, 26.5.1). The Node.js vulnerabilities by version guide lists the CVEs in each.
Which Node.js versions are still supported?
Node.js 22 until 30 April 2027, Node.js 24 until 30 April 2028, and Node.js 26, which becomes LTS on 28 October 2026, until 30 April 2029.
Should I upgrade from Node.js 20 to 22 or 24?
24. It is supported a year longer than 22, which ends on 30 April 2027. The extra work over 22 is mostly url.parse() and a few other removed or deprecated APIs.
Do I need to rebuild native modules when leaving Node.js 20?
Yes. Node.js 20 uses ABI version 115, 22 uses 127 and 24 uses 137, so every native add-on must be rebuilt or reinstalled for the new line.
Can I get security patches for Node.js 20?
Not from the Node.js project. Third-party extended security support, including OSSeva's, backports fixes to the 20.x runtime.
Still running Node.js 20?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.