Today, October 28 2026, Node.js 26 becomes Active LTS, and that changes the default choice for every team still deciding which Node line to run in production. Node 26 will stay supported until April 30 2029, while Node 24 moved to maintenance on October 20 2026 and Node 22 reaches end of life on April 30 2027. Node 20 and older lines get no fix at all. If your fleet still runs an old line, today is the day the upgrade stops being a someday task and becomes a dated plan.
The mistake teams make on a day like this is doing two risky things at once: patching a security flaw and jumping to a new major version in the same change. This post separates them. Step 1 is the patch you apply to the line you already run. Step 2 is the Node 26 move, tested on its own. Step 3 is a rollout checklist that keeps a working rollback in reach. Do them in that order and a failed upgrade costs you an afternoon, not a security fix.
What changes on October 28
Node 26 moves from Current to Active LTS on October 28 2026, with maintenance starting October 20 2027 and end of life on April 30 2029, according to the Node.js release schedule. Node 24 is now in maintenance, which means critical and security fixes only, until its end of life on April 30 2028. Node 22 is also in maintenance and ends April 30 2027, so a team still on 22 has about six months of support left and should plan its move now rather than during an incident.
The practical effect is on defaults. Fresh installs, container base images, and platform defaults start pointing at the new LTS line, and library authors start testing against it first. Staying on an older line is still possible for a while, but the support window is now visibly shrinking. That is why the right question today is not whether to move to 26, but in which order to patch, test, and roll out.
Step 1: Patch the line you already run
The October 21 2026 Node.js security release fixed CVE-2026-111497, nicknamed Node2Shell, in the Brotli decoder bundled with Node.js. It is an out-of-bounds write that can be triggered by decompressing attacker-controlled Brotli data, including through built-in fetch responses and request-body parsing in frameworks such as Express 5. Node.js rates the issue High; Google, as the CVE Numbering Authority, scores it 9.2 on CVSS 4.0. Those two numbers describe the same flaw from two angles, so do not let the difference confuse the priority: patch first.
The fixed versions are 22.23.4, 24.22.1, and 26.12.1. If you run Node 22, take 22.23.4. If you run Node 24, take 24.22.1. If you already run Node 26, take 26.12.1. Each is a patch release on your existing line, meant as a drop-in replacement, so it carries far less risk than a major-version jump. Node 20 and older have no official fix, so anything still on those lines should be treated as unpatched and moved off them, not left running behind a firewall and forgotten.
One status update matters for urgency. Reports on October 28 note that CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, with remediation due November 10. That is a reason to treat the patch as this week, not this quarter. It is not a reason to panic-upgrade to a new major version in the same change: the patch exists on your current line, so take it there first.
Step 2: Test the Node 26 move separately
Once the patched line is running, test Node 26 as its own project. The headline compatibility item is native modules: Node 26 uses NODE_MODULE_VERSION 147, so binaries compiled for an older Node ABI will not load until they are rebuilt or replaced with prebuilt binaries for 26. Reinstall dependencies on Node 26, run npm rebuild where needed, and check every package with a compiled component, especially private ones that no public registry will have prebuilt for you.
Then scan for the removals that actually break real code. Node 26 removes the legacy _stream_* private modules, removes res.writeHeader, and removes the --experimental-transform-types flag. These usually hide in old dependencies rather than in your own code, so grep your dependency tree as well as your source. Also watch for runtime deprecations that will become errors later, such as module.register, and retest outbound HTTP behaviour, since the bundled HTTP client has moved to a new major version. A clean test suite on 26 plus a clean native-module rebuild is the exit criteria for this step, not a feeling that the app looks fine.
Step 3: Rollout checklist
Roll out in this order. First, pin the exact Node version in your Dockerfiles, CI images, and version files, so a fresh build cannot silently drift to a different line. Second, deploy to a canary: one service, or a small share of traffic, with the patched old line still serving the rest. Third, watch the signals that actually catch a bad runtime upgrade: process crash loops, native-module load errors at startup, elevated error rates on outbound HTTP calls, and silent stops where a worker exits without an alert. A process that restarts cleanly can still be failing every request, so alert on error rate and on missing heartbeats, not only on whether the container is running.
Fourth, keep the rollback ready before you need it: the previous image tagged and tested, the previous Node line still available, and a runbook line that says who calls the rollback and on what signal. The rollback target is the patched old line, 22.23.4 or 24.22.1, not an unpatched version. That is the whole point of patching first: your fallback is already secure. Finally, log the new version everywhere your inventory tracks runtimes, because the next security advisory will ask which lines you run, and guessing under pressure is how a patched fleet turns out to have one forgotten host.
What to do this week
This week, in order: confirm every host and container reports a patched version, or a plan to move off an end-of-life line; open a Node 26 test branch with rebuilt native modules and a passing suite; and schedule the canary. Teams that run Node for blockchain infrastructure, RPC services, or API backends should treat the runtime like any other node dependency: versioned, monitored, and upgraded on a schedule, not when an advisory forces it. If you want that work handled as a managed upgrade rather than a fire drill, DevOps node operations and blockchain node setup are the services where we do it, and a free infra audit is the fastest way to find which of your hosts are still behind.
Disclaimer: This post is educational only, not financial advice. Figures are listing or project data as of 2026-10-28 and may change - always confirm version numbers, requirements, and dates in the official docs before acting on them.