Node.js 26 LTS on October 28: which version to run?

As of October 23, 2026, 01:15 JST (October 22, 16:15 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9); a second read of the sources at 01:11 JST found no change. Node.js 26 is scheduled to become LTS on October 28, 2026, and this page changes when it does.

Node.js 26 is scheduled to become LTS on October 28, 2026, and to be supported until April 30, 2029, per the Node.js release schedule. Until then, the project's rule, "Production applications should only use Active LTS or Maintenance LTS releases", points to Node.js 24 or 22.

Node.js 24 and 22 got the October 21, 2026 security fixes, in 24.22.1 and 22.23.4, and so did 26, in 26.12.1 (what that release fixed). Node.js 20 and 25 are past end of life and got none. Status as of 00:42 JST on October 23 (15:42 UTC on October 22): nodejs.org lists v26 as Current, with 26.12.1 as its latest release, and v24 and v22 as LTS.

Below: each line's dates, which line fits which situation, what the promotion changes for nvm install --lts, Docker's node:lts tag, and AWS Lambda, and the commands to check and switch.

Node.js release lines and their dates

The phase dates are from the Node.js release schedule, schedule.json (checked 00:42 JST), and each release date is from that release's notes on GitHub. The schedule is a plan. The Release working group's README says "Dates are subject to change." It also says the date a line moves to LTS is "chosen no later than the first day of the month it is to change", and that a change to a release date comes "with no less than 14 days notice".

One label differs between the project's pages. The README's own table still calls 24.x "Active LTS" (checked 00:45 JST), while schedule.json puts its Maintenance start at October 20, 2026, and nodejs.org's release page shows v24 as "LTS".

Which version should you run?

The Node.js project's rule is one sentence: "Production applications should only use Active LTS or Maintenance LTS releases." Each row below applies it to the dates above. Where a host decides which versions you can pick, its row under where each tool and host stands comes first.

What changes on October 28

By the Node.js project's own pages, three things change for Node.js 26:

• Its Current phase ends. The Release README defines Active LTS as "New features, bug fixes, and updates that have been audited by the Release team and have been determined to be appropriate and stable for the release line." nodejs.org adds that LTS "typically guarantees that critical bugs will be fixed for a total of 30 months."
• The LTS label arrives with a release. In the last three promotions, the first release to carry it was a minor release on the LTS date: 20.9.0 on October 24, 2023, 22.11.0 on October 29, 2024, and 24.11.0 on October 28, 2025 (nodejs.org's release index), each published between 14:50 and 17:45 UTC that day (GitHub, checked 02:42 JST), which is late that night or early the next morning in Japan. That release also brings 26's codename, which schedule.json leaves blank as of 00:42 JST.
• Tools that follow the LTS label move to 26. nvm's --lts, setup-node's lts/*, and Docker's node:lts tag all point at 24 as of October 23. The next table says what each one follows.

Node.js 27 starts the same day, as an alpha, and from 27 on the cycle changes. nodejs.org says: "Starting with Node.js 27, the release cycle will be annual and every major version will move to LTS status after its six-month Current phase (and six additional months of Alpha phase)." So 27 is scheduled to become Current on April 22, 2027, and LTS on October 20, 2027, with end of life on April 30, 2030. Up to 26, odd-numbered lines such as 25 never became LTS.

Where each tool and host stands

Each row is from the tool's or host's own page or data, with the time it was checked on October 23, in JST.

Security status of each line

The Node.js advisory says "End-of-Life versions are always affected when a security release occurs." The Brotli decoder bug, CVE-2026-111497, has a CVSS 4.0 base score of 9.2 from Google, which published the CVE record on October 22 at 13:35 UTC (NVD, checked 00:43 JST). CISA's Known Exploited Vulnerabilities catalog doesn't list it (catalog 2026.10.21, checked 00:43 JST). The Node.js October 2026 security release post covers all 10 CVEs, which apps can reach them, and the update steps. The same releases also block the compromised eMudhra intermediate certificates; Chrome's eMudhra root removal on October 27: what to do covers what that means for a website's certificate.

Check your version and switch

1. Find the version you run

Run node -v on each machine and in each image, or log process.version from the running app. The first number is the release line.

2. Pick the line

Find your situation in the table above, then check your host's row under where each tool and host stands. On Vercel, whose docs list no 26.x, and on AWS Lambda, where nodejs26.x is a preview, that means 24 for production as of October 23.

3. Install it

With nvm, run nvm install 24 (or nvm install 26), then nvm alias default 24 so new shells use it.

4. Pin it where your app is built

Write the line into an .nvmrc file (24), which nvm and Netlify read; into engines.node in package.json ("24.x"), which Vercel reads; into your Dockerfile's FROM line (node:24); and into setup-node's node-version (24). A pinned line stays put when the LTS label moves to 26.

5. Rebuild, redeploy, and check again

Rebuild images with docker build --pull, so the base image is fetched again instead of taken from your cache. Redeploy, restart running processes, and run step 1 against the running app.

Tell your users before you switch

Moving an app to 24 or 26 means a rebuild, a redeploy, and a restart, and the people who use it may hit errors while it restarts. Ask your coding agent to write one HTML page that says when you switch, how long the app may be down, and what users should do, if anything.

Convika turns that file into a link you can share before the switch: sign up free, drop the file on the upload screen, check the private preview, and publish. The page runs on Convika, not on your server, so it stays up while your app restarts. On the free plan the page is public: search engines and Convika's gallery may list it, so leave out exact versions, hostnames, IP addresses, and anything internal.

Publish my notice page

If what you run is only a page

Some apps are a single page with a sign-up form and no server code of their own. A page published on Convika is HTML that Convika serves at a convika.page address or your own domain, with its form handled by Convika, so there is no Node.js version for you to pick or update (publish an HTML page, add a form without a backend). If what you built needs a server, a database, or a login, it doesn't run there, and the tables above apply.

Updates to this page

• October 23, 2026, 01:15 JST: first version.

This page changes once Node.js 26's first LTS release is out, which the schedule puts on October 28, 2026: its status, its codename, its first LTS release, and the nvm, setup-node, and Docker rows. It also changes when Vercel, AWS Lambda, or Netlify change their Node.js 26 support, and when the next Node.js security release is announced.

Frequently asked questions

When does Node.js 26 become LTS?

October 28, 2026, per the Node.js release schedule (checked October 23, 00:42 JST). It is scheduled to stay in Active LTS until October 20, 2027, then Maintenance until its end of life on April 30, 2029. The project's README says "Dates are subject to change."

Is Node.js 26 LTS yet?

No, not as of October 23, 2026, 00:42 JST. nodejs.org lists v26 as Current, with 26.12.1 as its latest release, and the release schedule gives October 28, 2026 as its LTS date.

Which Node.js version should I use for production?

An LTS line. The Node.js project says "Production applications should only use Active LTS or Maintenance LTS releases." As of October 23, 2026, those are 24, supported until April 30, 2028, and 22, until April 30, 2027. From October 28, 26 is scheduled to join them, supported until April 30, 2029, if your host offers it.

Is Node.js 24 still supported?

Yes. Node.js 24 "Krypton" has been in Maintenance LTS since October 20, 2026, and is supported until April 30, 2028. Its latest release is 24.22.1, the security release of October 21, 2026.

Is Node.js 22 end of life?

No. Node.js 22 "Jod" is in Maintenance LTS until its end of life on April 30, 2027, and 22.23.4 has the October 21, 2026 security fixes. AWS Lambda forecasts deprecating its nodejs22.x runtime the same day, April 30, 2027.

Is Node.js 20 still supported?

No. Node.js 20 "Iron" reached end of life on April 30, 2026, and got no fix in the October 21, 2026 security release. Its last release is 20.20.2, from March 24, 2026. Move to 24, or to 26 once it is LTS.

Is Node.js 25 supported?

No. Node.js 25 reached end of life on June 1, 2026. Up to Node.js 26, odd-numbered lines never became LTS, and 25's last release is 25.9.0, from April 1, 2026.

Does nvm install --lts install Node.js 26?

No, not as of October 23, 2026, 00:44 JST. nvm install --lts installs 24.22.1, because nodejs.org's release index gives 26.12.1 no LTS name. It installs 26 once a 26.x release in the index carries one, which the schedule puts on October 28.

Does the Docker node:lts tag change to Node.js 26?

Not yet. As of October 23, 2026, 00:43 JST, node:lts is 24.22.1 on Debian bookworm. By the rule in the image's tag script, lts moves to 26, on Debian trixie, once the tag list is regenerated after 26's LTS date of October 28. Pin node:24 to stay on 24.

What happens to Node.js 27?

Node.js 27 is scheduled to start as an alpha on October 28, 2026, become Current on April 22, 2027, and become LTS on October 20, 2027, with end of life on April 30, 2030. From 27 on, every line becomes LTS after six months as Current, and the alpha releases are "not for production use".

Sources

Times are October 23, 2026, in JST (UTC+9).

• Node.js release schedule, schedule.json (00:42) and the Release working group's README (00:45)
• Node.js Releases (00:42)
• nodejs.org release index, index.json and index.tab (00:42, 00:44)
• Release notes for v26.12.1, v24.22.1, v22.23.4, v25.9.0, and v20.20.2 (00:42)
• Release notes for the last three first LTS releases, v20.9.0, v22.11.0, and v24.11.0 (02:42)
• Node.js: Wednesday, October 21, 2026 Security Releases (00:42)
• CVE.org: CVE-2026-111497 and NVD: CVE-2026-111497 (00:43)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.21 (00:43)
• nvm README and nvm.sh (00:44)
• actions/setup-node README and actions/node-versions manifest (00:44)
• Docker official images: library/node, and nodejs/docker-node's stackbrew.js and versions.json (00:43)
• Homebrew: node, node@24, and node@22 (00:43)
• Vercel: Supported Node.js versions (00:44)
• AWS Lambda: Lambda Event Function runtimes (00:44)
• Netlify: Manage build dependencies and Netlify: Configuration for functions (00:44, 00:45)