---
title: "WEB-NODE-001 Node.js Version Past End of Life"
canonical: https://openvapt.com/checks/WEB-NODE-001.html
html: https://openvapt.com/checks/WEB-NODE-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-NODE-001 Node.js Version Past End of Life

Checks whether the installed Node.js runtime is a release line that no longer receives security fixes.

- Domain: Web Apps
- Severity: High
- Control category: Patch and Vulnerability Management
- Fix effort: high
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 2.2
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104
- OWASP Top 10 2021: A06:2021
- OWASP ASVS 4.0.3: 14.2.1
- NIST SP 800-53 Rev. 5: SI-2, SA-22
- Benchmark topic: Use supported software (topic only, no benchmark text)

## Why It Matters

After end of life the Node.js project publishes no more security releases, so every later vulnerability in the runtime, its bundled OpenSSL or its HTTP parser stays open for good.

## How It Detects

Runs node --version (or nodejs --version), a read-only command, and compares the major version with the Node.js release schedule's end-of-life dates.

## How to Fix

Move to an Active or Maintenance LTS release (even-numbered majors), for example with the NodeSource or distribution packages, test the application, then restart its service.

## How to Verify

```
node --version  shows a supported LTS major.
```

## Learn the Theory

- [P13 Application Servers: Tomcat, Node.js and Python](https://openvapt.com/academy/p13.md)

## References

- [Node.js Release Working Group, release schedule](https://github.com/nodejs/Release)
- [endoflife.date, Node.js (community-maintained lifecycle data)](https://endoflife.date/nodejs)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go

Run it: `openvapt scan --only WEB-NODE-001`. Read it offline: `openvapt explain WEB-NODE-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-NODE-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.