Node.js 26 moved into Long Term Support on 28 October 2026 with release 26.13.0, under the codename “Lithium”. A few days later the project published a detailed write-up of the V8 changes coming in Node.js 27 (now in Alpha) and announced security releases for 11 November 2026.

If you run Node in production, you have three things to deal with this month: plan the move to 26 LTS, prepare for the security patch, and know which V8 changes in 27 could affect you. This guide covers all three.

What “LTS Lithium” means for you

According to the Node.js 26.13.0 release notes:

  • Node.js 26.x will receive updates until the end of April 2029.
  • Apart from metadata such as process.release, 26.13.0 has no changes compared with 26.12.1. If you were already on 26.12.1, nothing in your code changes.
  • If you’re coming from Node 24, 22 or older: since Node.js 25, the official Linux binaries are linked against libatomic, which you may need to install separately depending on your distribution.

LTS is the version line most companies standardise on, so this is the right time to plan the move from 24 or 22.

Step 1: Install Node 26 LTS

With nvm:

nvm install 26
nvm use 26
node -v                      # v26.13.0 or later
node -p "process.release.lts" # 'Lithium'

If you use Docker, pin the major version in your Dockerfile rather than latest:

FROM node:26-slim

On a minimal Linux image, install libatomic first if Node fails to start with a missing-library error:

# Debian/Ubuntu
apt-get update && apt-get install -y libatomic1
# Alpine
apk add libatomic

Step 2: Update your project settings

Tell tools and teammates which version you support:

{
  "engines": {
    "node": ">=26"
  }
}

And add an .nvmrc file so nvm use picks it up automatically:

echo "26" > .nvmrc

Step 3: Test in CI on both versions

Run your test suite on your current version and on 26 side by side, so any differences show up clearly:

strategy:
  matrix:
    node: [24, 26]
steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: ${{ matrix.node }}
      cache: npm
  - run: npm ci
  - run: npm test

Native addons are the most common cause of upgrade problems. Run npm rebuild after switching versions and watch for packages that need new prebuilt binaries.

Step 4: Be ready for the 11 November security release

The Node.js project has announced security releases for 26.x, 24.x and 22.x on or shortly after Wednesday, 11 November 2026. The highest severity fixed in each line is HIGH. End-of-life versions are always affected when a security release happens, so you should upgrade if you are still on an EOL line.

A simple checklist:

  1. Make sure your deployment pipeline can roll out a new Node patch version quickly.
  2. Use version ranges in Docker tags (for example node:26-slim) and rebuild images after the release, or pin and bump the exact version.
  3. Watch the Node.js blog on the release day for details.

Looking ahead: V8 changes in Node.js 27

Node.js 27 Alpha upgrades V8 from 14.6 to 15.6. Joyee Cheung’s post on notable V8 changes lists the changes worth testing early.

New language features enabled by default

Math.sumPrecise([0.1, 0.2, 0.3]); // 0.6 (instead of 0.6000000000000001)

[1, 2, 3].values().map(x => x * 2).join('-'); // '2-4-6'
new Set(['a', 'b']).values().includes('b');   // true

Iterator.zip([[1, 2], ['a', 'b']]).toArray();  // [[1, 'a'], [2, 'b']]

Changes that could break tests

  • Math results may differ in the last bit. Node 27 uses LLVM’s libm for some Math methods. For example, Math.log(3) returns 1.0986122886681098 instead of 1.0986122886681096. Tests that compare floats to hard-coded values should use a tolerance:
import assert from 'node:assert';

function assertClose(actual, expected, eps = 1e-12) {
  assert.ok(Math.abs(actual - expected) < eps, `${actual} != ${expected}`);
}
assertClose(Math.log(3), 1.0986122886681096);
  • Math.random() with --random-seed gives a different sequence. Update any snapshot tests that relied on it.
  • Sorting uses PowerSort for bigger arrays. It’s still stable and results with a consistent comparator are unchanged, but tests that count comparator calls may change.
  • error.stack no longer comes from the prototype chain. Object.create(err).stack is now undefined.

Serialization is not backward compatible

v8.serialize(), structuredClone() and postMessage use a new format. Older Node versions can’t read data serialized by Node 27, though 27 can read older data. If you store serialized V8 data in caches or queues shared between services, upgrade the readers first.

Memory defaults change

On machines with 4 GB to 15 GB of RAM, the default old-generation heap limit is larger. For example, on an 8 GB machine it goes from 2 GB to 4 GB. If you relied on the old default to cap memory in containers, set it explicitly:

node --max-old-space-size=2048 server.js

Common upgrade pitfalls

  • Old global tools. Packages installed globally with npm belong to one Node version. After switching with nvm, reinstall the CLIs you need.
  • Lockfiles built on an older version. Run a clean npm ci on Node 26 in CI, not only locally, so you catch native-module problems early.
  • Hard-coded version checks. Search your code for checks on process.version or process.versions.node that assume an older major version.

Recommended plan

  1. This week: install 26 LTS locally, add it to CI, fix anything that breaks.
  2. 11 November: apply the security patches to whichever lines you run.
  3. Next few weeks: move production to 26 LTS.
  4. Optional: run your tests on 27 Alpha to catch the float, sort and serialization changes early. Don’t run Alpha in production.

Takeaway

Node.js 26 “Lithium” is now the LTS line to target, with support until April 2029. Move to it soon, patch on 11 November, and use the Node 27 Alpha notes to make your tests more robust before the next major release.

Sources: Node.js 26.13.0 (LTS) · November 11, 2026 Security Releases · Notable V8 changes from Node.js 26 to 27 (Alpha)