# Node.js 18.20.8: end of life

This release line no longer gets security fixes.

- Recommended: 22.23.4 (lowest fixed release that is still supported)
- Known vulnerabilities: 14 (1 critical, 5 high, 6 medium, 2 low)
- End of life: yes, since 2025-04-30 (release line 18)
- Data as of: 2026-10-24 23:07 UTC

## Vulnerabilities

| ID | Severity | Actively exploited | Fixed in |
|---|---|---|---|
| [CVE-2024-3566](https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/) | critical | no | — |
| [CVE-2026-21710](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) | high | no | — |
| [CVE-2025-59465](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases) | high | no | — |
| [CVE-2025-27210](https://nodejs.org/en/blog/vulnerability/july-2025-security-releases) | high | no | 20.19.4 |
| [CVE-2025-23166](https://nodejs.org/en/blog/vulnerability/may-2025-security-releases) | high | no | — |
| [CVE-2025-55131](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases) | high | no | — |
| [CVE-2025-23167](https://nodejs.org/en/blog/vulnerability/may-2025-security-releases) | medium | no | — |
| [CVE-2026-21717](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) | medium | no | — |
| [CVE-2026-21713](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) | medium | no | — |
| [CVE-2026-21637](https://nodejs.org/en/blog/vulnerability/december-2025-security-releases) | medium | no | — |

And 4 more with lower severity.

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/nodejs/18.20.8 · JSON: https://fixedin.dev/nodejs/18.20.8.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt