Node.js 20 end of life: what to do now
Node.js 20 stopped getting security fixes on 30 April 2026. Here is where to move, what breaks on the way, and how to upgrade servers, Docker images and Lambda functions.
- End of life
- 30 April 2026, 190 days ago
- Node 22
- Ends 30 April 2027: too close
- Move to
- Node 24 (to April 2028) or 26 (to April 2029)
- Path
- Straight to the new version, rebuilding native modules
Where Node 20 is still hiding
Node is installed in more places than the main application server, which is why version 20 lingers after its date. Check all of them:
Servers: node -v, and look for version managers (nvm, n, fnm, asdf) that install Node per user, outside the package manager.
Docker images: grep -r "FROM node" . across your repositories. An image tagged node:20 or node:lts pinned to an old digest still runs 20.
Build pipelines: CI configuration (setup-node versions, .nvmrc, engines in package.json) often pins Node separately from the servers.
Serverless: Lambda functions on the nodejs20.x runtime, and the same in other clouds.
24 or 26?
Node 26 for most moves now. It became the active LTS on 28 October 2026 and is supported to April 2029, a year longer than 24. It is also the last version on the old two-a-year pattern: from Node 27, there is one release a year and every release becomes an LTS.
Node 24 if a key dependency doesn't support 26 yet. It has had a year in LTS, the ecosystem's support for it is complete, and it is supported to April 2028.
Not Node 22. It ends in April 2027, so a move to it now is a move you make twice.
What breaks on the way up
| Area | What changed | What to watch |
|---|---|---|
| Native modules | Each major version changes the binary interface | Packages with compiled parts (bcrypt, sharp, sqlite3, canvas) must be reinstalled or rebuilt on the new version. Delete node_modules and install fresh, rather than copying it across. |
| TLS and keys | Node 24 brought a newer OpenSSL at a stricter security level | RSA, DSA and DH keys under 2048 bits are refused. Old internal certificates and legacy partner APIs are the usual failures. |
| Modules | require() of ES modules works by default from Node 22 | Mostly good news, but code that detected ESM by catching the old error, and some bundler set-ups, behave differently. |
| Deprecated APIs | Old APIs move from warnings to removal | url.parse() and other long-deprecated calls warn or change. Run the app with --throw-deprecation on the rehearsal copy to find them. |
| npm | Each Node major ships a newer npm | Lock files may be rewritten and old peer-dependency conflicts become errors. Commit the new lock file deliberately. |
| System libraries | Official builds need a recent glibc | Very old Linux releases (CentOS 7, Ubuntu 18.04) can't run the official binaries. The OS has to move first; see the CentOS 7 page. |
How to upgrade
Change the version in one place first: the CI pipeline. Run the test suite on Node 24 or 26 and fix what fails, before any server changes.
Update every pin. .nvmrc, engines in package.json, the Docker FROM line (pin a specific version, such as node:26-bookworm-slim, rather than lts), and the Lambda runtime.
Install Node from a supported source on servers: the NodeSource repository, the official binaries or a version manager under a service user. Restart every process manager (systemd, PM2) so nothing keeps running on the old binary.
Roll out like any release: to staging first, then production behind the load balancer one server at a time, with the previous image or package kept ready.
How I run the move
- 01Inventory and a fixed quote
Every server, image, pipeline and function still on Node 20, and which of the changes above will bite. Then a fixed quote.
- 02Rehearsal on staging
A copy upgraded or rebuilt first, every site and job tested, every problem fixed there.
- 03The window, with a way back
The real move at a time you agree, the old server or a snapshot kept ready, then two weeks' stabilisation.
Upgrades and migrations →
Questions
When did Node.js 20 reach end of life?
On 30 April 2026. The Node.js project releases no more security fixes for 20.
Which Node version should I move to?
Node 24, in maintenance to April 2028, or Node 26, which became the active LTS on 28 October 2026 and is supported to April 2029. Node 22 ends in April 2027, so moving to it now means doing this again within months.
Can I jump straight from Node 20 to 24 or 26?
Yes. There is no need to stop at each version. Read the breaking changes for each major in between, rebuild the native modules, and run the tests on the new version.
What about AWS Lambda?
AWS deprecated the nodejs20.x runtime on 30 April 2026: it gets no more security patches and no technical support. Creating new Node 20 functions is blocked from 29 July 2027 and updating existing ones from 31 August 2027. Move them to nodejs24.x before then.
Is there paid support for Node 20?
Yes. Vendors such as HeroDevs sell security fixes for end-of-life Node versions. It buys time; the upgrade is usually cheaper.
Why does Node 24 or 26 refuse my old certificate or key?
From Node 24, Node uses a newer OpenSSL at a stricter security level, which refuses RSA, DSA and DH keys shorter than 2048 bits. Old internal certificates and some legacy APIs are the usual cause.
Still on Node 20?
Tell me where it runs. I'll find every copy, tell you what will break on 26 and give you a fixed quote for the move.