Node.js 26 LTS on October 28: which version to run?

As of November 5, 2026, 15:06 JST (06:06 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). Node.js 26 became LTS on October 28, 2026.

Updated November 5, 2026, 15:06 JST: Node.js 26 "Lithium" has been in Active LTS since October 28, with 26.13.0 as its first LTS release, and nvm install --lts, setup-node's lts/*, Docker's node:lts, and Vercel's default now give 26. CISA added CVE-2026-111497, the Brotli bug of the October 21 security release, to its Known Exploited Vulnerabilities catalog on October 27, and Node.js has announced its next security release for November 11.

Node.js 26 "Lithium" became LTS on October 28, 2026, and is supported until April 30, 2029, per the Node.js release schedule. The project's rule, "Production applications should only use Active LTS or Maintenance LTS releases", now points to Node.js 26, 24, or 22: 26 for a new app, where your host offers it.

Node.js 26, 24, and 22 got the October 21, 2026 security fixes, in 26.12.1, 24.22.1, and 22.23.4 (what that release fixed), and Node.js 20 and 25, past end of life, got none. One of those fixes, for CVE-2026-111497, is now urgent: CISA lists the bug as exploited. Node.js has announced its next security release, for 26.x, 24.x, and 22.x, “on or shortly after, Wednesday, November 11, 2026.” Status as of 14:58 JST on November 5 (05:58 UTC): nodejs.org lists v26, v24, and v22 as LTS, with 26.13.0 as the latest release of v26, and v27 as Alpha.

Below: each line's dates, which line fits which situation, what the promotion changed for nvm install --lts, Docker's node:lts tag, and AWS Lambda, and the commands to check and switch.

Node.js release lines and their dates

The phase dates are from the Node.js release schedule, schedule.json (checked November 5, 14:58 JST). Each release date is from that release's notes on GitHub (for 26.13.0, 24.22.2, and 27.0.0-alpha.0.0.0, checked November 5, 15:50 JST). The schedule gives October 28 as 27's alpha start, and its first alpha's notes are dated October 29. The schedule is a plan. The Release working group's README says "Dates are subject to change." It also says the date a line moves to LTS is "chosen no later than the first day of the month it is to change", and that a change to a release date comes "with no less than 14 days notice".

The project's pages now agree on the labels. The README's table calls 26.x "Active LTS", 24.x and 22.x "Maintenance LTS", and 27.x "Alpha" (checked November 5, 15:05 JST), and nodejs.org's release page shows v26, v24, and v22 as "LTS".

Which version should you run?

The Node.js project's rule is one sentence: "Production applications should only use Active LTS or Maintenance LTS releases." Each row below applies it to the dates above. Where a host decides which versions you can pick, its row under where each tool and host stands comes first.

What changed on October 28

By the Node.js project's own pages, three things changed for Node.js 26:

• Its Current phase ended. The Release README defines Active LTS as "New features, bug fixes, and updates that have been audited by the Release team and have been determined to be appropriate and stable for the release line." nodejs.org adds that LTS "typically guarantees that critical bugs will be fixed for a total of 30 months."
• The LTS label arrived with a release. As in the last three promotions, 20.9.0 on October 24, 2023, 22.11.0 on October 29, 2024, and 24.11.0 on October 28, 2025, the first release to carry it was a minor release on the LTS date: 26.13.0, on October 28, 2026 (nodejs.org's release index, checked November 5, 14:58 JST). The index names it "Lithium", the codename schedule.json now gives 26.
• Tools that follow the LTS label moved to 26. As of November 5, nvm's --lts, setup-node's lts/*, and Docker's node:lts tag all give 26.13.0. The next table has each one.

Node.js 27's first alpha followed on October 29, and from 27 on the cycle changes. nodejs.org says: "Starting with Node.js 27, the release cycle will be annual and every major version will move to LTS status after its six-month Current phase (and six additional months of Alpha phase)." So 27 is scheduled to become Current on April 22, 2027, and LTS on October 20, 2027, with end of life on April 30, 2030. Up to 26, odd-numbered lines such as 25 never became LTS.

Where each tool and host stands

Each row is from the tool's or host's own page or data, with the time it was checked on November 5, in JST.

Security status of each line

The Node.js advisory says "End-of-Life versions are always affected when a security release occurs." The Brotli decoder bug, CVE-2026-111497, has a CVSS 4.0 base score of 9.2 from Google, which published the CVE record on October 22 at 13:35 UTC, and the NVD's own CVSS 3.1 score is 9.8. It is being exploited: CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a due date of November 10 for US federal agencies (catalog 2026.11.04 and NVD, checked November 5, 14:56 JST). Node.js has announced its next security release, for 26.x, 24.x, and 22.x, “on or shortly after, Wednesday, November 11, 2026” (checked 14:58 JST): update again that week. The Node.js October 2026 security release post covers all 10 CVEs, which apps can reach them, and the update steps. The same releases also block the compromised eMudhra intermediate certificates; Chrome's eMudhra root removal on October 27: what to do covers what that means for a website's certificate.

Check your version and switch

1. Find the version you run

Run node -v on each machine and in each image, or log process.version from the running app. The first number is the release line.

2. Pick the line

Find your situation in the table above, then check your host's row under where each tool and host stands. On AWS Lambda, where nodejs26.x is still a preview, that means 24 for production as of November 5. Vercel's docs list 26.x as the default.

3. Install it

With nvm, run nvm install 26 (or nvm install 24), then nvm alias default 26 so new shells use it.

4. Pin it where your app is built

Write the line into an .nvmrc file (26), which nvm and Netlify read; into engines.node in package.json ("26.x"), which Vercel reads; into your Dockerfile's FROM line (node:26); and into setup-node's node-version (26). Use 24 in each place to stay on 24, as on AWS Lambda until nodejs26.x leaves preview. A pinned line stays put when the LTS label moves.

5. Rebuild, redeploy, and check again

Rebuild images with docker build --pull, so the base image is fetched again instead of taken from your cache. Redeploy, restart running processes, and run step 1 against the running app.

Tell your users before you switch

Moving an app to 24 or 26 means a rebuild, a redeploy, and a restart, and the people who use it may hit errors while it restarts. Ask your coding agent to write one HTML page that says when you switch, how long the app may be down, and what users should do, if anything.

Convika turns that file into a link you can share before the switch: sign up free, drop the file on the upload screen, check the private preview, and publish. The page runs on Convika, not on your server, so it stays up while your app restarts. On the free plan the page is public: search engines and Convika's gallery may list it, so leave out exact versions, hostnames, IP addresses, and anything internal.

Publish my notice page

If what you run is only a page

Some apps are a single page with a sign-up form and no server code of their own. A page published on Convika is HTML that Convika serves at a convika.page address or your own domain, with its form handled by Convika, so there is no Node.js version for you to pick or update (publish an HTML page, add a form without a backend). If what you built needs a server, a database, or a login, it doesn't run there, and the tables above apply.

Updates to this page

• November 5, 2026, 15:06 JST: Node.js 26 as LTS since October 28, with 26.13.0 "Lithium" as its first LTS release; Node.js 27's first alpha on October 29; 24.22.2; nvm, setup-node, Docker's node:lts, and Vercel on 26, and Homebrew's node at 26.13.0 and node@24 at 24.22.2; CISA's catalog listing CVE-2026-111497 since October 27; the security release announced for November 11. AWS Lambda's and Netlify's rows are unchanged.
• October 23, 2026, 01:15 JST: first version.

This page changes when Node.js ships the November 11 security release, when AWS Lambda launches nodejs26.x as a managed runtime, and when Netlify changes its functions fallback.

Frequently asked questions

When does Node.js 26 become LTS?

It became LTS on October 28, 2026, with the 26.13.0 release, per nodejs.org's release index and the release schedule (checked November 5, 14:58 JST). It is scheduled to stay in Active LTS until October 20, 2027, then Maintenance until its end of life on April 30, 2029. The project's README says "Dates are subject to change."

Is Node.js 26 LTS yet?

Yes. Node.js 26 "Lithium" has been in Active LTS since October 28, 2026, and 26.13.0 is its first LTS release. nodejs.org lists v26 as LTS (checked November 5, 2026, 14:58 JST).

Which Node.js version should I use for production?

An LTS line. The Node.js project says "Production applications should only use Active LTS or Maintenance LTS releases." As of November 5, 2026, those are 26, supported until April 30, 2029, 24, until April 30, 2028, and 22, until April 30, 2027. For a new app, use 26 if your host offers it.

Is Node.js 24 still supported?

Yes. Node.js 24 "Krypton" has been in Maintenance LTS since October 20, 2026, and is supported until April 30, 2028. Its latest release is 24.22.2, from October 28, 2026; the October 21 security fixes are in 24.22.1 and later.

Is Node.js 22 end of life?

No. Node.js 22 "Jod" is in Maintenance LTS until its end of life on April 30, 2027, and 22.23.4 has the October 21, 2026 security fixes. AWS Lambda forecasts deprecating its nodejs22.x runtime the same day, April 30, 2027.

Is Node.js 20 still supported?

No. Node.js 20 "Iron" reached end of life on April 30, 2026, and got no fix in the October 21, 2026 security release. Its last release is 20.20.2, from March 24, 2026. Move to 26 or 24.

Is Node.js 25 supported?

No. Node.js 25 reached end of life on June 1, 2026. Up to Node.js 26, odd-numbered lines never became LTS, and 25's last release is 25.9.0, from April 1, 2026.

Does nvm install --lts install Node.js 26?

Yes, since October 28, 2026. As of November 5, 2026, 14:58 JST, nvm install --lts installs 26.13.0, the newest release that nodejs.org's release index names "Lithium". To stay on 24, run nvm install 24.

Does the Docker node:lts tag change to Node.js 26?

Yes, it has. As of November 5, 2026, 14:58 JST, node:lts is 26.13.0 on Debian trixie, the same image as node:latest and node:current. Pin node:24, which is 24.22.2 on Debian bookworm, to stay on 24.

What happens to Node.js 27?

Node.js 27's first alpha came out on October 29, 2026. It is scheduled to become Current on April 22, 2027, and LTS on October 20, 2027, with end of life on April 30, 2030. From 27 on, every line becomes LTS after six months as Current, and the alpha releases are "not for production use".

Sources

Times are in JST (UTC+9), on October 23, 2026, and November 5, 2026, where given.

• Node.js release schedule, schedule.json (00:42; November 5, 14:58) and the Release working group's README (00:45; November 5, 15:05)
• Node.js Releases (00:42; November 5, 14:58)
• nodejs.org release index, index.json and index.tab (00:42, 00:44; November 5, 14:58)
• Node.js: Wednesday, November 11, 2026 Security Releases, posted November 4, 2026, 08:00 JST (November 3, 23:00 UTC) (November 5, 14:58)
• Release notes for v26.13.0, v24.22.2, and v27.0.0-alpha.0.0.0 (November 5, 15:50)
• Release notes for v26.12.1, v24.22.1, v22.23.4, v25.9.0, and v20.20.2 (00:42)
• Release notes for the last three first LTS releases, v20.9.0, v22.11.0, and v24.11.0 (02:42)
• Node.js: Wednesday, October 21, 2026 Security Releases (00:42)
• CVE.org: CVE-2026-111497 and NVD: CVE-2026-111497 (00:43; November 5, 14:56)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.21 (00:43) and version 2026.11.04 (November 5, 14:56)
• nvm README and nvm.sh (00:44)
• actions/setup-node README (00:44) and actions/node-versions manifest (00:44; November 5, 14:58)
• Docker official images: library/node (00:43; November 5, 14:58), and nodejs/docker-node's stackbrew.js and versions.json (00:43)
• Homebrew: node, node@24, and node@22 (00:43; November 5, 14:58)
• Vercel: Supported Node.js versions (00:44; November 5, 14:58)
• AWS Lambda: Lambda Event Function runtimes (00:44; November 5, 14:58)
• Netlify: Manage build dependencies and Netlify: Configuration for functions (00:44, 00:45; November 5, 15:05, 14:58)