Node.js

How Node.js versioning, EOL & security support work

Node.js ships a new major version every six months, alternating between odd-numbered majors, which run as short-lived Current releases, and even-numbered majors, which get promoted to Long Term Support (LTS). Once a major reaches LTS it moves through an Active LTS phase, recommended for general production use, and then a Maintenance LTS phase before end of life. This is why several majors are typically maintained at once.

Node.js runs a dedicated security process: reports are triaged, validated against every supported line, fixed under embargo, assigned a CVE, and then disclosed with an announcement to the nodejs-sec mailing list alongside coordinated security-release patches. Because fixes are only backported to lines still inside Current, Active LTS, or Maintenance LTS, a version already past end of life will never receive a patch for a newly disclosed vulnerability.

Sources: Node.js Previous Releases, Node.js Security Reporting

Data sourced from endoflife.date.