Leaving Node.js 20: a migration checklist

Why now

The Node.js release page lists Node.js 20 as end of life. The 21 October security release fixed ten CVEs in the 22, 24 and 26 lines, and Node.js 20 gets none of them. Every month you stay on it, the list of known and unfixed issues grows.

1. Find every Node 20

Look beyond the main service. Old versions hide in places nobody owns.

# Containers
docker run --rm your-image:tag node -v

# Lambda functions
aws lambda list-functions --query "Functions[?starts_with(Runtime,'nodejs20')].[FunctionName,Runtime]" --output text

# Repositories: version pins
grep -rnE "node-version|FROM node:|\"node\":|nodejs20" --include="*.yml" --include="*.yaml" --include="Dockerfile*" --include="package.json" --include=".nvmrc" .

Also check .nvmrc, .tool-versions, CI matrices and the engines field in package.json.

2. Pick the target

Move to the newest LTS you can support, 24 for most teams. Moving 20 to 22 first is fine if a dependency is not ready. Do not stop on an old line you will have to leave again in a few months.

3. Test in the order that finds problems fast

Run the tests on the new version in CI as an extra matrix entry. Do not change production yet.
Rebuild native modules. Anything that compiles C or C++ needs a fresh install: npm ci on the new version, not a copied node_modules.
Turn deprecation warnings on. They show what will break next.

node --trace-deprecation app.js

Run the service under production like load in staging and compare memory, CPU and latency with the old version.
Check the base image. A node:24-slim image may differ from your old image in libc, OpenSSL and system packages. Run your container tests again.

4. Roll out in small steps

Move one low risk service first. Keep the old image tag so you can roll back in minutes. Watch error rate and latency for a full business cycle before the next service.

5. Make it stick

Pin the Node version in .nvmrc, in the Dockerfile and in CI from one source of truth.
Let Dependabot or Renovate update the base image and the Actions.
Put the Node release schedule in your team calendar. End of life dates are known years ahead.

How we can help

We run this as a short, fixed price engagement: inventory, test matrix, staged rollout and a plan so you do not repeat it next year. Book a call from the button below.