· 6 min read

Node.js 26 Became LTS on October 28 With Temporal On by Default. Node 22 Stops Getting Security Fixes April 30, 2027. Here's the Upgrade Order for a One-Person Stack.

Stack

Node.js 26 entered Long Term Support on October 28, 2026, under the codename Lithium. Release 26.13.0 contains no code changes from 26.12.1 apart from metadata that now marks it as LTS, so there is nothing new to test. What changed is your calendar: Node 26 gets security fixes until April 30, 2029, and every older line is now closer to its end.

The support dates

These come from the official Node.js release schedule.

Node 20 reached end of life on April 30, 2026. If anything you run still uses it, you are already on an unsupported runtime. Node 22 is in maintenance and ends April 30, 2027. Node 24 moved into maintenance on October 20, 2026 and ends April 30, 2028. Node 26 is Active LTS, with maintenance starting October 20, 2027 and end of life on April 30, 2029. Node 27 is listed for a stable release in April 2027, reaching LTS in October 2027. A 27.0.0 alpha was published on October 29.

The practical read for a solo operator: nothing forces you to move to 26 this month. The forcing date is April 30, 2027 for anyone on 22.

What 26 actually changes

Temporal is enabled by default in Node 26, per the 26.0.0 release notes. It is the modern replacement for the legacy Date object, with proper time zones and calendar math. If you have ever written a bug involving daylight saving time in an invoice or subscription renewal, this is the feature that matters to you.

Node 26 also ships V8 14.6, which adds Map.prototype.getOrInsert() and getOrInsertComputed() (the second runs its callback only when the key is missing) and Iterator.concat(). The HTTP client behind fetch, Undici, moves to version 8.0.2.

The release notes list breaking changes, and four are worth checking against your stack:

  • NODE_MODULE_VERSION is now 147, so any native addon built for an earlier version must be rebuilt. That hits things like image libraries and database drivers with compiled bindings.
  • Official Linux binaries link against libatomic (the 26.13.0 notes say this has been true since Node 25). On a slim Docker base image it may be missing, and the failure shows up at container start.
  • http.Server.prototype.writeHeader() is removed. Use writeHead().
  • module.register() now emits a runtime deprecation warning, and the legacy _stream_readable, _stream_writable and related modules are gone. The --experimental-transform-types flag is also removed.

If your code is plain application code on well-maintained frameworks, most of these won't touch you. Your dependencies might.

The upgrade order

Order matters more than version. Here is what I'd do, depending on where you start.

On Node 20: move now, and go straight to 24, not 26. You are out of support, and 24 gives you a conservative jump with security fixes through April 2028. Spend the effort once, then plan a second hop later.

On Node 22: you have until April 30, 2027, which is six months. Don't rush, but don't wait for the last week either. Pick a quiet month in the first quarter of 2027. Whether you target 24 or 26 depends on your dependencies, which leads to the next step.

On Node 24: stay put. It will receive security fixes for another 18 months. Revisit in mid-2027.

For new projects: start on 26. Writing new code against a runtime with Temporal and 2029 support means one less migration.

The test I'd run before any hop

Change one thing in a branch: the Node version, in .nvmrc or your Dockerfile. Then run your install, your tests, and a production build. Watch for the native addon rebuild first, because that is the failure that takes an hour to diagnose. Then build your Docker image and run the container, not just the app, since a missing libatomic only appears there. Finally, deploy to a preview environment before production, because your host may not offer the new runtime on day one.

That last point is the real constraint for most solo stacks. Check that your hosting platform lists Node 26 as a supported runtime before you plan anything. LTS status in the Node project does not mean your platform has shipped it.

Where this advice could be wrong

If you rely heavily on a native module that lags behind, staying on 24 until mid-2027 may be the right call even for new projects. Likewise, if you have a time-handling bug today, Temporal is a reason to move sooner than the calendar says, since one report says it remains behind an experimental flag in Node 24. I'm assuming your pain is a deadline, not a feature.

What I'd actually do

Check what version every project and server of yours runs, today, with node --version. Write the answer in a list. Anything on 20 gets a ticket this month. Anything on 22 gets a ticket for Q1 2027. New work starts on 26. Everything else waits.

Author

Lukas

Sources

More Stack articles →

Newsletter

The week, in one email.

The weekly summary of what happened and what it means for people who build alone. No spam, unsubscribe any time.

Form not showing? Subscribe on this page instead.

Related Posts

AWS Shipped a Free Local Emulator That AI Agents Keep Up to Date. Telemetry Is On by Default and IAM Is Not Checked. Here Is How I'd Use It.

AWS Emulator runs AWS APIs on your laptop with no account and no fee, and it hit about 785 points on Hacker News. It also skips IAM policy checks, keeps state in memory, and sends usage data to AWS unless you switch it off. Good for fast tests, wrong for security tests.

Apple's Claris Is Testing Harbor, a Private AI Server That Pools Memory Across Macs Over Thunderbolt 5. Here Is What It Would Replace in My Setup.

Claris, an Apple company, has a private preview page for Harbor: run open-weight models on Macs you own, and pool unified memory across two or more Thunderbolt 5 Macs. No price, no named models, no API spec. Here is what is confirmed, what is not, and the math to run before you buy hardware for it.

Google's Gemini Decisions API Scores Up to 1,000 Questions per Request at $0.10 per Million Input Tokens. It Changes Yesterday's Self-Host Math.

Google launched a hosted decision model on November 11 that returns probabilities instead of text, bills only input tokens, and lets one request answer up to 1,000 questions. Against a rented GPU, the self-host break-even jumps from about 1,500 calls a day to tens of thousands. Test the accuracy before you switch.