Is your Node.js version still safe?
.nvmrc, package.json or a Dockerfile FROM line. We check it against the Node.js project’s own vulnerability list and release history, and endoflife.date for support dates.Result for 26.12.0
No known vulnerabilities in Node.js 26.12.0
Node.js 26 is supported until Apr 30, 2029
- Newest 26.x release
- 26.12.0 (no known advisories)
- Newest LTS release
- 24.22.0
Last checked against Node.js releases, Node.js Security WG and endoflife.date.
Node.js release lines today
The newest Node.js release lines, their end-of-life dates from endoflife.date, and whether the newest release in each supported line has known core vulnerabilities today.
| Line | Support | Newest release | Advisories in it |
|---|---|---|---|
| Node.js 26 | Supported until Apr 30, 2029 | 26.12.0 | None known |
| Node.js 25 | End of life since Jun 1, 2026 | 25.9.0 | No more fixes |
| Node.js 24 LTS | Supported until Apr 30, 2028 | 24.22.0 | None known |
| Node.js 23 | End of life since Jun 1, 2025 | 23.11.1 | No more fixes |
| Node.js 22 LTS | Supported until Apr 30, 2027 | 22.23.3 | None known |
Node.js 2626.12.0
Supported until Apr 30, 2029
Advisories in the newest release: None known
Node.js 2525.9.0
End of life since Jun 1, 2026
Advisories in the newest release: No more fixes
Node.js 24 LTS24.22.0
Supported until Apr 30, 2028
Advisories in the newest release: None known
Node.js 2323.11.1
End of life since Jun 1, 2025
Advisories in the newest release: No more fixes
Node.js 22 LTS22.23.3
Supported until Apr 30, 2027
Advisories in the newest release: None known
Last checked against endoflife.date, Node.js releases and Node.js Security WG.
Where the Node.js data comes from
OSV.dev covers packages, not the Node.js runtime, so this checker reads the Node.js project’s own sources:
- nodejs.org/dist/index.json, which lists every release and marks the security releases, so we can tell how many you’ve missed in your line.
- The Node.js Security Working Group’s core vulnerability list, with each CVE, the release lines it affects, the patched releases and its severity.
- CISA KEV and FIRST EPSS for those CVEs, and endoflife.date for support dates.
End-of-life Node.js is worse than its list
The Node.js project’s security release posts say that “End-of-Life versions are always affected when a security release occurs” (July 2026 security releases). Once a line is past end of life, new vulnerabilities aren’t assessed for it, so a result for an end-of-life version lists only what was found while it was supported. The result also counts the security releases shipped since, none of which it got.
Running Node.js on AWS Lambda or in a container? The end-of-life checker shows the Lambda runtime’s deprecation dates and the Docker tag to move to.
Questions
How do I find my Node.js version?
Run node --version where the app runs: on the server, in the container (docker run --rm your-image node --version) and in CI. They often differ from your laptop.
What is an NSWG-COR id?
The Node.js Security Working Group’s own id for a vulnerability in Node.js core. Most also have a CVE, which we show first.
Does it check my npm packages too?
No, this page checks Node.js itself. For your packages, use the package.json checker or paste the repo into the dependency check, which also reads .nvmrc and engines.
Why does it suggest an LTS release?
Long-term support lines get security fixes for longest, and the Node.js project recommends them for production. The table above shows each line’s dates from endoflife.date.
Go further than one check
Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.