Forkward

Node.js 20, end of life since 30 April 2026

Node.js 20 end of life

Node.js 20 stopped receiving security fixes on 30 April 2026; its last release is 20.20.2. The US National Vulnerability Database lists 1 vulnerability in Node.js that affect 20.20.2, 1 of them published after end of life. None of them has an official fix for Node.js 20.

  • 1open vulnerabilities in 20.20.2
  • 1published after end of life
  • 1critical
  • 1exploited in the wild

Exploited in the wild

Node.js 20.20.2 carries CVE-2026-111497.

CVE-2026-111497 (score 9.8) is listed in the CISA catalogue of known exploited vulnerabilities. Node.js 20 is past end of life, so no official release will fix it for this line.

Read the NVD entry

What you can do

Keep Node.js 20, patched

We backport the security fixes to Node.js 20, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.

Upgrade

Move to Node.js 24, supported until 30 April 2028, if your applications can make the jump. Our fixes keep you safe while you plan it.

Assess first

Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.

Request a server assessment

Known vulnerabilities in Node.js 20.20.2

US National Vulnerability Database, 28 October 2026, highest score first: vulnerabilities in Node.js that affect 20.20.2. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.

CVEScoreSeverityPublishedDescription
CVE-2026-111497 Exploited9.8Critical2026-10-22A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.