End-Of-Life (EOL)
What is EOL Software?
End-Of-Life software is software that is no longer maintained by its creators. Node.js has releases going back to 2015, and it's simply not feasible to maintain all release lines in perpetuity. Major versions are released, patched, and designated End-Of-Life on a schedule.
View the Node.js release schedule.
Why Using EOL Software is Dangerous
When a version reaches End-Of-Life, it means that it will no longer receive updates, including security patches. This can leave applications running on these versions vulnerable to security issues and bugs that will never be fixed.
End-Of-Life versions are dangerous. They are now completely unsupported, meaning they receive no updates, including security patches.
The security implications are immediate and serious. For example, when new security releases reveal issues and patches against major lines, the security advisory notes, "End-of-Life versions are always affected when a security release occurs", meaning all earlier versions have these same vulnerabilities but will never receive patches.
EOL Versions
| Node.js (Codename) | Last updated | Vulnerabilities | Details |
|---|---|---|---|
| v23 | High (2)Medium (2) | Details | |
| v21 | High (6)Medium (5) | Details | |
| v19 | High (1)Medium (3)Low (2) | Details | |
| v18 (Hydrogen) | High (11)Medium (19)Low (4) | Details | |
| v17 | High (1)Medium (3)Low (1) | Details | |
| v16 (Gallium) | High (8)Medium (18)Low (4) | Details | |
| v15 | Critical (1)High (3)Low (1) | Details | |
| v14 (Fermium) | Critical (2)High (12)Medium (15)Low (5) | Details | |
| v13 | Details | ||
| v12 (Erbium) | Critical (1)High (10)Medium (8)Low (3) | Details | |
| v11 | Details | ||
| v10 (Dubnium) | Critical (1)High (4)Medium (1)Low (1) | Details | |
| v9 | Details | ||
| v8 (Carbon) | Details | ||
| v7 | Details | ||
| v6 (Boron) | Medium (2) | Details | |
| v5 | Details | ||
| v4 (Argon) | Details | ||
| v0 | Details |
Commercial Support
We understand that some organizations face constraints that prevent immediate upgrades, such as legacy codebases, compliance requirements, or complex dependency chains. If your company cannot upgrade immediately but needs continued security support for End-Of-Life versions of Node.js, commercial support is available through HeroDevs.
As part of the OpenJS Ecosystem Sustainability Program partnership, HeroDevs provides Never-Ending Support (NES) for Node.js versions past their official maintenance phase. This includes security patches, compliance assistance, and technical support to help bridge the gap while you plan your upgrade strategy.
However, this should be viewed as a temporary solution—the goal should always be to upgrade to actively supported versions.