Node.js 26 is now the version to run in production. On October 28, 2026, the Node.js project published version 26.13.0, codenamed Lithium, and moved the 26.x line into Long Term Support (LinuxCompatible's LTS coverage, retrieved October 29, 2026). The release itself adds nothing new: the release notes state that, other than updating metadata such as the process.release object, there are no further changes from version 26.12.1. What changes is the promise behind the version. Version 26 is now a supported, patched, long term target, with updates planned through April 30, 2029.
Key Takeaways
Node.js 26.13.0, codenamed Lithium, moved the 26.x line into Active LTS on October 28, 2026, with support through April 30, 2029.
Version 26.13.0 adds no new code beyond 26.12.1. It is a status change, not a feature release, so code that ran on 26.12.1 should behave the same.
The LTS line carries the Temporal API enabled by default, V8 14.6, and Undici 8, plus the October 21, 2026 security fixes for the 22.x, 24.x, and 26.x lines.
Node.js 26 is the last line under the old two majors per year schedule. From Node.js 27 onward, there is one major release per year and every release becomes LTS.
Teams on Node.js 22 should plan to move straight to 26, not stop at 24. Teams still on Node.js 20 or older get no upstream security fixes at all.
That last point deserves emphasis, because LTS promotions are easy to file under routine maintenance and forget. This one is also a closing chapter. Node.js 26 is the final release line built under a schedule that is ten years old, and the next line already started under new rules on the same day. Understanding what 26.13.0 locks in, and what comes after it, is the difference between a calm upgrade and a rushed one a year from now.
What Node.js 26.13.0 Changes, and What It Does Not
Long-Term Support (LTS) is the status the Node.js project gives a release line it recommends for production use, with bug and security fixes over a defined period. Current is the earlier phase, when a new major line is still collecting its first fixes and is not yet the recommended production target. Node.js 26 spent about six months as Current after its May 5, 2026 debut, and the LTS promotion is the moment the project says the line is ready to be a long term base.
The promotion follows the project's usual pattern. A line enters Active LTS, where it receives bug and security fixes, and later moves to Maintenance, where fixes narrow to critical and security issues. The Node.js release schedule lists the dates for Node.js 26 as Active LTS from October 28, 2026, Maintenance from October 20, 2027, and end of life on April 30, 2029. Node.js 24, codenamed Krypton, moved to Maintenance on October 20, 2026 and ends on April 30, 2028. Node.js 22, codenamed Jod, is already in Maintenance and ends on April 30, 2027.
Release line | Status after October 28, 2026 | End of life |
|---|---|---|
Node.js 22 (Jod) | Maintenance LTS | April 30, 2027 |
Node.js 24 (Krypton) | Maintenance LTS since October 20, 2026 | April 30, 2028 |
Node.js 26 (Lithium) | Active LTS from October 28, 2026; Maintenance from October 20, 2027 | April 30, 2029 |
Node.js 27 | Alpha from October 28, 2026; Current in April 2027; LTS in October 2027 | April 30, 2030 |
If you are already on 26.12.1, the upgrade to 26.13.0 is the smallest kind of upgrade there is: a version number and a support promise, with no code change underneath. Check with node -v. A reading of 26.13.0 or higher means you are on the patched, now LTS line, according to LinuxCompatible's coverage. If you are on an earlier 26.x build, move to at least 26.13.0 so you also pick up the October security fixes described below.
What the LTS Line Actually Carries
The features in Node.js 26 arrived in May 2026, not in the LTS release, but the LTS label is what makes them safe to build on. Three of them define the line.
Temporal is the standards track date and time API designed to replace the JavaScript Date object. Date has well known problems: it is mutable, so a function can change a date another part of the program still holds; it mixes local time and UTC in confusing ways; and month end arithmetic produces surprises. Temporal splits the concepts apart. Temporal.PlainDate handles a calendar date with no time zone. Temporal.ZonedDateTime handles a moment in a specific time zone. Durations are their own type, and arithmetic returns a new object instead of mutating the old one. In Node.js 26, Temporal ships enabled by default, with no experimental flag, so new server code can use it without a dependency or a flag.
That matters most for date heavy server work: scheduling, billing, calendars, and log processing. Teams that once reached for a date library for every project can now do much of that work with the runtime itself. One caution still applies. Browser support for Temporal is a separate question from Node.js support, so code shared between server and browser needs its own check before it drops a date library entirely.
V8 14.6 is the JavaScript engine version in Node.js 26, taken from Chromium 146. It adds upsert methods in the form of Map.prototype.getOrInsert() and WeakMap.prototype.getOrInsert(), which return an existing value or insert and return a new one in a single call, plus iterator sequencing through Iterator.concat(). The engine bump also moves NODE_MODULE_VERSION to 147, which has a practical consequence for native add-ons: prebuilt binaries compiled against earlier Node.js versions need rebuilding, according to LinuxCompatible's coverage. If a native dependency fails to load after the upgrade, a rebuild against Node.js 26 is the first thing to try.
Undici 8 is the HTTP client layer behind Node.js built in fetch, and Node.js 26 ships Undici 8 as its HTTP layer. That upgrade brings closer alignment with the WHATWG Fetch specification and tighter streaming and connection handling. For high throughput services, that should mean more predictable behavior across environments. It is also a reason to test before deploying, because low level fetch semantics can shift in subtle ways that only a real request pattern reveals.
Node.js 26 also removes legacy surface area, and the removals are the part of the upgrade most likely to break old code. The Node.js 26 upgrade guide from Fireup lists the headline removals: http.Server.prototype.writeHeader() is gone in favor of writeHead(); the legacy _stream_* modules are gone; module.register() is runtime deprecated and prints warnings; and the --experimental-transform-types flag is removed. Most breakage will come from old transitive dependencies, not from your own code, so run the full test suite and watch for deprecation warnings before production traffic finds the problem.
The Security Release the LTS Line Inherits
A week before the LTS promotion, on October 21, 2026, Node.js shipped security releases for the 22.x, 24.x, and 26.x lines. Because 26.13.0 sits directly on top of 26.12.1, LTS users inherit the whole set. The official October 2026 security advisory covers ten issues across those lines, with the highest severity rated High. The headline issue is a Brotli decoder flaw: malformed compressed input could write past the end of an internal decoder buffer, which the advisory says can lead to a crash, disclosure of process memory, or remote code execution. Brotli decompression happens automatically in fetch and in common body parsers, so no special action by an attacker is needed to reach the decoder.
The other High issues cluster around TLS and DNS. One lets a loosely resolving host bypass TLS hostname checks, another repeats that trick using fullwidth digit IP addresses, and a third truncates names containing a NUL byte in dns.resolve. The remaining issues include a keep-alive socket problem, an entropy cache leak into startup snapshots and single executable applications, and two Permission Model bypasses. The release also updated bundled dependencies, including c-ares, Undici, and the CA root store.
Two operational details matter as much as the patch itself. First, a running process keeps the old decoder in memory until it exits, so restart after upgrading, and rebuild container images from a fresh base image rather than assuming an old image is fixed. Second, the advisory warns that end of life versions are always affected when a security release occurs. Node.js 20 reached end of life on April 30, 2026, so it receives no fix for any of these issues. If a system still runs Node.js 20 or older, the upgrade is not optional maintenance. It is the only way back onto a patched line.
Why Node.js 26 Is the Last of Its Kind
Under the schedule Node.js used for a decade, two major releases shipped each year, in April and October, and only even numbered lines became LTS. Odd numbered lines were short lived Current releases that most production teams skipped. The project's announcement of the new schedule says that model created real costs: odd numbered releases saw minimal adoption, the odd and even distinction confused newcomers, and a mostly volunteer team had to maintain four or five active release lines at once, with each extra line adding backporting work.
Aspect | Through Node.js 26 | From Node.js 27 on |
|---|---|---|
Major releases per year | Two, in April and October | One, in April |
Which lines become LTS | Even numbered lines only | Every release line |
Short lived odd lines | Yes | Gone, replaced by an Alpha phase |
Early testing channel | Odd releases and nightlies | Alpha, October to March, semver major changes allowed |
LTS window | 30 months | 30 months, unchanged |
Total support, Current to end of life | 36 months | 36 months, unchanged |
From October 2026, the new model is one major release per year in April, with LTS promotion each October, and every release becomes LTS. A new Alpha phase runs for six months, October to March, and allows semver major changes, followed by six months as Current and then 30 months of LTS. Alpha builds are signed, tagged, and tested, but they are not intended for production use. Version numbers will also track the calendar year of the first Current release, so 27.0.0 arrives in 2027 and 28.0.0 in 2028.
The project is explicit about what this means for most teams. If you already only upgrade to LTS versions, little changes beyond version numbering. The change matters most to library authors, who are asked to test Alpha releases in continuous integration as early as possible, because a bug found only after LTS promotion is a bug users will hit. Node.js 27 opened its Alpha channel on October 28, 2026, the same day Node.js 26 entered LTS, and it ships as 27.0.0 in April 2027 before entering LTS in October 2027.
Who Should Move, and When
If you run Node.js 26 already, the decision is made: move to 26.13.0 or higher, restart your processes, and rebuild your images. If you run Node.js 24, you have until April 30, 2028, but Node.js 24 is now in Maintenance, so expect security and critical fixes rather than new features, and plan the move to 26 on your own schedule rather than under pressure.
If you run Node.js 22, the choice is between 24 and 26, and 26 is the better target. Node.js 22 ends on April 30, 2027, so stopping at 24 buys support only until April 30, 2028, while going straight to 26 buys support until April 30, 2029 for the same migration effort. The catch is that a jump from 22 also inherits everything Node.js 25 removed and the Node.js 26 removals, plus the npm major jump from npm 10 to npm 11, so test the full dependency tree, rebuild native add-ons, and check for the removed APIs listed above.
If you run Node.js 20 or older, treat the migration as a security task, not a roadmap item. Those lines receive no upstream fixes, and every future security release will leave them exposed. For containerized workloads, pin the base image to the new line and rebuild, rather than patching a running container. Our Docker explainer covers what containers are and why image pinning matters, and our CI/CD explainer covers how automated pipelines can run the upgrade checks on every change instead of once a year.
Frequently Asked Questions
Is Node.js 26.13.0 a feature release? No. It adds no new code beyond 26.12.1 apart from metadata such as the process.release object. Its importance is the LTS promotion: Node.js 26 is now the recommended production line, supported through April 30, 2029.
Should I upgrade from Node.js 24 to 26 right away? Not urgently. Node.js 24 is in Maintenance LTS until April 30, 2028, so it still receives security and critical fixes. Plan the move to 26 so you are not forced into it near the end of that window, and test native add-ons and removed APIs first.
What if I am still on Node.js 20? Upgrade as a security task. Node.js 20 reached end of life on April 30, 2026, and the Node.js project states that end of life versions are always affected by security releases without receiving a fix. Move to Node.js 26 for the longest support window.
Does Node.js 26 remove anything that can break my app? Yes, for old code. It removes http.Server.prototype.writeHeader() and the legacy _stream_* modules, deprecates module.register() at runtime, and removes the --experimental-transform-types flag. The risk usually sits in old transitive dependencies, so run the full test suite before deploying.
What changes with Node.js 27? Node.js 27 is the first line under the new annual schedule: Alpha from October 28, 2026, Current release in April 2027, and LTS promotion in October 2027, with end of life on April 30, 2030. Every release from 27 onward becomes LTS, and the odd and even distinction goes away.
The Bottom Line
Node.js 26.13.0 is a quiet release with a loud message. The code is the same code that shipped a week earlier, but the label on it now says production, and the calendar behind it runs to April 30, 2029. It also closes an era: the last line under the old twice a year schedule, carrying Temporal by default, a modern V8, and a new HTTP layer into the long term, just as the project switches to one major release a year. Upgrade to 26.13.0 or higher, restart, rebuild your images, and use the breathing room to test Node.js 27 Alpha in continuous integration before it becomes the next LTS. Start with the official release schedule announcement and the October 2026 security advisory, or read the Indonesian version of this article.