• Maintenance & security

Node.js version update and website migration: a 2026 guide

Old Node.js versions stop getting security fixes and slow your site down. Here is what a Node.js version update involves, the real risk of running an end-of-life version, and how to migrate safely.

4 min read

A Node.js version update keeps the engine under your website current, and in 2026 that matters more than usual. Node.js is the software that runs server-side JavaScript: the back end of countless web apps, APIs, dashboards and real-time features is built on it. Like any engine, each Node.js version is supported for only so long. This guide explains why old Node.js versions are risky, what a version update changes, and how a careful Node.js website migration moves you to a supported version without downtime.

How Node.js support works, and why it ends

Node.js releases a new major version every six months. The even-numbered releases (18, 20, 22, 24, 26) become “LTS”, or Long Term Support, and are maintained for about three years. After that they reach end of life and stop receiving any fixes, including security fixes.

As of October 2026 the picture is this: Node.js 18 reached end of life in April 2025, and Node.js 20 reached end of life in April 2026, so both are now unsupported. Node.js 22 is supported until April 2027, Node.js 24 until April 2028, and Node.js 26 is the newest line. You can check the live schedule on the official Node.js releases page.

The security risk of old Node.js versions

Here is why those dates are not just bureaucracy. On 21 October 2026, Node.js shipped a security release fixing ten vulnerabilities. The most serious, CVE-2026-111497, is a flaw in Node's built-in Brotli decompressor that lets an attacker run their own code on your server, a full takeover. Others let attackers bypass TLS certificate checks (CVE-2026-105483 and CVE-2026-106069) or poison DNS lookups (CVE-2026-105482).

The fixes went into Node.js 22.23.4, 24.22.1 and 26.12.1. They did not go into Node.js 20 or 18, because those lines are end of life, so they were simply left unpatched. If your site runs on Node 20 or earlier, those holes are open on your server right now, and no official fix is coming. You can read the official security release notes for the full list. In practice that means:

  • A full server takeover from a single malicious request, used to steal data or hold you to ransom.
  • TLS and DNS flaws that let attackers intercept traffic between your site and your customers.
  • Failed security reviews that stall enterprise deals and payment approvals.
  • Growing dependency problems, because new libraries stop supporting the old Node version too.

What a Node.js version update changes

Moving to a current Node.js version is usually a good trade. Newer versions are faster, handle more traffic on the same server, and unlock modern JavaScript features and libraries. They also keep your whole dependency tree installable, because npm packages gradually drop support for end-of-life Node, so staying current avoids a dead end.

The work involved is mostly about dependencies. Your project's npm packages each have their own Node version requirements; some will need updating alongside Node itself, and a few may carry breaking changes. Your build tools and your hosting runtime, meaning the Node version on your server, in your Docker image or on your serverless platform, all need to line up.

How we run a Node.js website migration

  • Audit: we record your current Node version, your package.json and lockfile, your build and your hosting runtime, and flag packages that won't survive the jump.
  • Plan: you get a written plan with the target LTS version, the dependency work, a timeline and a fixed price.
  • Upgrade on a branch: we update Node and dependencies on a copy, fix what breaks, and run the test suite and the app end to end.
  • Deploy safely: we match the runtime on your server or platform, release to staging, then switch at a quiet time with a rollback ready.
  • Monitor: we watch logs, errors and performance after the switch and tidy up anything that surfaces.

If your product is a web app, API or dashboard rather than a simple site, this is core to our web application development work. Tell us what you're running and we'll map out the move.

Which Node.js version should you be on?

Target an even-numbered LTS line that still has a good support window. As of late 2026 that means Node.js 22 or 24 for most sites, supported into 2027 and 2028 respectively. Avoid the odd-numbered versions (23, 25) in production: they are short-lived and never become LTS. If you run a full MongoDB, Express, React and Node stack, see our MERN version update guide for how the pieces fit together.

The bottom line

A Node.js version update is routine, but the clock is real: once a version is end of life, serious security holes like the October 2026 Brotli flaw are never patched on it. Staying on a supported LTS line keeps your site patched, fast and easy to maintain. Not sure which Node version your site runs, or facing a jump from Node 18? Tell us what you have and we'll give you a clear, fixed-price plan.

Common questions

How do I know which Node.js version my site uses?

Ask your developer or host, or run “node -v” on the server. As of 2026, Node.js 18 and 20 are both end of life and no longer patched. If you are on 20 or earlier you should plan an update now; Node.js 22 and 24 are the current supported long-term lines.

Is it risky to run an end-of-life Node.js version?

Yes. The October 2026 security release fixed ten flaws, including a remote-code-execution bug in Node's Brotli decompressor, but only for Node 22, 24 and 26. Versions like Node 18 and 20 received no fix, so those holes stay open permanently on sites still running them.

Will a Node.js update break my app?

The risk is mostly in dependencies: npm packages with their own version rules or breaking changes. We upgrade on a copy, fix what breaks, run the tests, and keep a rollback ready, so the switch stays invisible to your users.

What is the difference between a version update and a migration?

A version update swaps the Node.js runtime under your existing app. A migration goes further, moving the app to a new server, host or platform and often updating dependencies and configuration along the way. The two usually happen together.

How often should I update Node.js?

Plan to move off a version before it reaches end of life, which works out to roughly every two to three years, since each long-term line is supported for about three years. Staying one supported line behind the newest is a sensible, low-risk target for most businesses.

  • Maintenance & security4 min read

    PHP version update and website migration: a 2026 guide

    Running an old PHP version quietly puts your website at risk. Here is what a PHP version update involves, why end-of-life versions are dangerous, and how a careful PHP website migration keeps your site fast and secure.

  • Maintenance & security4 min read

    MERN stack version update and migration to a new version: a 2026 guide

    A MERN app has four moving parts, each on its own release clock. Here is how to plan a MERN version update, why old versions are a risk, and how to migrate MongoDB, Express, React and Node.js to new versions safely.

What does your business need next?

Start with a short call. You’ll get honest advice and a written plan, whether or not we end up working together.

Start a projecthello@hackeroot.com