WebBuilding

Software and platforms

Node.js

Summary

Node.js is a free, open-source runtime that runs JavaScript outside the web browser, on Google's V8 engine, so the same language can power servers, command line tools and the build tools behind many websites. Ryan Dahl released an early version in June 2009. The project is now hosted by the OpenJS Foundation, and as of October 2026 W3Techs counts Node.js as the web server on 7.4% of websites whose server it can identify.

Web Building Encyclopedia · Software and platforms · Last reviewed October 22, 2026 · 10 min read

What Node.js is

Node.js is a free, open-source program that runs JavaScript outside a web browser. The project describes it as a “cross-platform JavaScript runtime environment” for building servers, web apps, command line tools and scripts.1 A runtime is the program that takes code and carries it out on a computer.

At its center is V8, the JavaScript engine Google built for Google Chrome. Node.js runs V8 outside the browser.2 Around it, Node.js adds a standard library of input and output functions for jobs a server needs, such as reading files and using the network.2

That gave JavaScript a second home. The project’s own introduction points out that millions of front-end developers who write JavaScript for the browser can also write the server side without learning a different language.2 It adds that developers choose which version of the language they use by choosing the Node.js version, instead of waiting for visitors to update their browsers.2

Node.js turns up on the web in two different roles:

  • As the server. A Node.js program can answer HTTP requests itself, doing the job of a web server. As of October 2026, W3Techs counts Node.js as the web server on 7.4% of websites whose server it can identify.3 Its list of popular sites using Node.js includes GitHub.com, Netflix.com and Spotify.com, though for all three it detected Node.js only on a subdomain.3
  • As a tool. Many sites never run Node.js in public, but the people who build them use it every day for command line tools and scripts, such as the WordPress tool that sets up a new block project.14

In Stack Overflow’s 2025 Developer Survey, 48.7% of the people who answered the web frameworks and technologies question said they had used Node.js, the highest share of any entry in that category.5 Node.js is released under the MIT License, a permissive open-source license.6

Origins: Ryan Dahl and Joyent

Node.js was created by Ryan Dahl, a self-employed programmer who had studied mathematics. Before Node.js he wrote Ebb, an event-driven web server for the Ruby language, and grew frustrated trying to make it fast.7 He concluded that large speed gains needed non-blocking input and output (I/O) through the whole software stack, so that a program never stops to wait for a disk or a network.7

Dahl tried C and then the Lua language, which had too many libraries that blocked. About six months in, he turned to JavaScript. He began with SpiderMonkey, the engine in Mozilla Firefox, and after about two days switched to Google’s V8.7

The project started as web.js, meant as an alternative to the Apache HTTP Server, and was renamed node.js as it grew into a broader framework.7 An early version came out in June 2009. Few people noticed until Dahl gave a 45-minute demonstration at JSConf 2009 that ended in a standing ovation, The Register reported in 2011. The cloud computing company Joyent hired him about a month later.7

Early Node.js ran on Windows only through Cygwin, a compatibility layer. Version 0.6.0, dated November 4, 2011 in its changelog, added native Windows support, built on the Windows system called I/O Completion Ports.8 Dahl’s announcement listed benchmarks in which a simple HTTP test on Windows went from 3,858 to 5,823 requests per second compared with version 0.4.12.8

On January 30, 2012, with what he called the libuv-based rewrite largely complete, Dahl handed his role as the project’s “gatekeeper” to Isaac Schlueter. Schlueter took final say over what went into releases, and Dahl stayed at Joyent to advise from the sidelines.9 Schlueter was best known as the creator of npm, the Node.js package manager.10

How Node.js works

A common way for server software to handle many visitors is to give each connection its own operating system thread, a separate line of execution.1 Node.js takes another approach. A Node.js app runs in a single process and does not create a new thread for each request.2 The project calls thread-based networking “relatively inefficient and very difficult to use.”1

When a Node.js program needs to read a file, query a database or wait on the network, it does not sit idle. It starts the operation, moves on to other work and resumes when the response comes back. The introduction says this lets one server handle thousands of concurrent connections without the bugs that managing threads can cause.2

The mechanism is the event loop. A program registers callbacks, functions to run when something happens, such as a new connection arriving. Node.js enters the event loop after running the main script and exits when no callbacks are left. When there is no work to do, it sleeps.1 The project notes that this matches how JavaScript already behaves in a browser, where the loop is hidden from the programmer.1

Underneath sits libuv, a support library for asynchronous I/O that was developed mainly for Node.js. It provides the event loop on each operating system, using epoll on Linux, kqueue on macOS and the BSD systems and I/O Completion Ports on Windows, along with a thread pool for jobs such as file system operations that cannot avoid waiting.1112

A design without threads does not limit a program to one processor core, the project says.1 Version 0.6.0 had already added built-in load balancing across several Node.js processes.8

The smallest web server in the Node.js documentation is about a dozen lines long. It loads the built-in http module, sets the status code and content type, replies “Hello World” and listens on port 3000 of the local machine.2

Two module systems

Node.js programs are split into modules, files that export code for other files to use. Node.js began with its own format, CommonJS, which loads code with require(). It also supports ECMAScript modules, the official standard format, which use import and export statements.132

ECMAScript modules stopped needing a command-line flag in versions 13.2.0 and 12.17.0, and the implementation was marked stable in 15.3.0, 14.17.0 and 12.22.0.13 Node.js treats a file as an ECMAScript module if its name ends in .mjs or if the project’s package.json settings file contains “type”: “module”.13

npm and the package ecosystem

npm is the package manager most closely tied to Node.js. A package is a bundle of reusable code that other projects can install. npm’s documentation describes three parts: a website for finding packages, a command line client that most developers use from a terminal and the registry, a large public database of JavaScript software. npm calls it the world’s largest software registry.14

Schlueter announced npm 1.0 on the Node.js blog in 2011, on a page dated May 1, 2011. Among the changes, each project’s dependencies were now nested inside it, and the ls command showed a tree of installed packages. He wrote that npm was meant as a development tool, not an “apt-wannabe,” a reference to the apt package manager used on Linux systems.15

On March 16, 2020, GitHub announced that npm was joining GitHub. At the time npm hosted more than 1.3 million packages and served about 75 billion downloads a month, GitHub said, and it promised to keep the public registry free.16

Much of what developers build with Node.js comes from that registry. Express, which calls itself a “minimalist web framework for Node.js,” is installed with one npm command. Its home page shows version 5.3.0 as of October 2026 and carries an OpenJS Foundation copyright line.17

Depending on many packages has a cost, because each one is code written by someone else. In September 2025 a self-replicating worm called Shai-Hulud spread through npm via compromised maintainer accounts. It added malicious install scripts to popular packages and stole secrets so it could keep spreading. GitHub was notified on September 14 and removed more than 500 compromised packages.18

On September 22, 2025, GitHub announced changes in response: publishing would be limited to three routes (local publishing with required two-factor authentication, granular tokens or trusted publishing), granular tokens would have a seven-day lifetime and legacy classic tokens would be deprecated.18

io.js, foundations and other runtimes

Joyent sponsored and oversaw Node.js for its first years. In December 2014, a group of contributors copied the code into a fork, a separate project, called io.js. They wanted more frequent releases and a community-run project without one company in charge.19

On February 10, 2015, Joyent announced a Node.js Foundation with partners including Fidelity, IBM, Microsoft, PayPal and the Linux Foundation.19 The two codebases came back together in Node.js 4.0.0, released on September 8, 2015. Version numbers jumped from 0.12 straight to 4.20

The foundation’s announcement said 4.0.0 combined the Node.js and io.js projects, turned on many features of the ES6 version of JavaScript by default and adopted semantic versioning, in which the first number changes when a release can break existing code. It also introduced a long-term support plan, with a new release line every six months.21 The same announcement put Node.js downloads at more than 2 million a month.21

On March 12, 2019, the Node.js Foundation and the JS Foundation merged to form the OpenJS Foundation, whose projects also include jQuery and webpack. The press release gives two counts for the projects, 31 in its opening paragraph and 29 in its closing section.22 As of October 2026, the Node.js website carries the line “Copyright OpenJS Foundation and Node.js contributors.”1

Two newer runtimes are defined partly by how they differ from Node.js. Dahl, Bert Belder and Bartek Iwańczuk released Deno 1.0 on May 13, 2020. Their announcement said Node.js, designed in 2009 when JavaScript was “a much different language,” had become slow to change because of its large user base. Deno runs code in a sandbox, so a script needs an explicit flag, for example, before it can use the network.23

Bun 1.0 followed on September 8, 2023. Its authors built it on Apple’s WebKit engine instead of V8 and called it “a drop-in replacement for Node.js.”24

Versions and the release schedule

Node.js has put out a new major version every six months, even-numbered versions in April and odd-numbered ones in October.25 A new major version spends six months as “Current.” Odd-numbered versions then lose support, and even-numbered versions move to long-term support (LTS), which typically means critical bugs are fixed for 30 months in total.20 Each LTS line gets a codename, such as Iron for version 20 and Krypton for version 24. The project says production applications should only use Active LTS or Maintenance LTS releases.20

The release lines that matter as of October 22, 2026 are these:2520

VersionCodenameFirst releasedStatusEnd of life
26None yetMay 5, 2026Current; Active LTS from October 28, 2026April 30, 2029
24KryptonMay 6, 2025Maintenance LTS from October 20, 2026April 30, 2028
22JodApril 24, 2024Maintenance LTSApril 30, 2027
20IronApril 2023End of lifeApril 30, 2026

The newest releases, 26.12.1 and 24.22.1, are both dated October 21, 2026 on their release pages. Both are security releases. They share the same five vulnerabilities (CVEs) rated high, in Node.js’s TLS and DNS code and in the bundled Brotli compression library.2627

Node.js 26.0.0, released on May 5, 2026, updated V8 to version 14.6 and turned on the Temporal API by default. Temporal is a newer way of handling dates and times than JavaScript’s original Date object.28 Version 26 is the last release line under the twice-yearly model.29

Starting with Node.js 27, the project will release one major version a year. Each will spend six months in a testing phase called Alpha from October, six months as Current from April and 30 months in LTS, for 36 months in all. Every version will become LTS, and version numbers will follow the calendar year of the first Current release, so 27.0.0 is planned for 2027 and 28.0.0 for 2028.29 The release team said odd-numbered versions saw little use and that keeping four or five release lines patched was hard for a mostly volunteer project. The announcement, last updated on March 10, 2026, says the plan is not final.29

Features added along the way

  • fetch. Node.js 18 (April 2022) added an experimental global fetch, the same function browsers use to request data without reloading a page, the technique known as Ajax. It came from the undici library.30
  • Test runner. The same release added a built-in node:test module for writing automated tests.30
  • Permission model. Added in version 20.0.0, it lets a program run with limits on what it may touch. The documentation calls it a “seat belt” for trusted code and warns that it does not protect against malicious code.31
  • TypeScript. Node.js can run TypeScript files directly by replacing the type annotations with blank space. This type stripping was turned on by default in 23.6.0 and 22.18.0 and marked stable in 25.2.0 and 24.12.0.32 It does no type checking, ignores tsconfig.json files and rejects TypeScript features that need code to be generated, such as enums. Its parser needs WebAssembly to be available.32

Timeline

  1. Node.js 26.12.1 and 24.22.1 security releases fix five high-severity CVEs26
  2. Node.js 24 Krypton moves to Maintenance LTS25
  3. Node.js 26.0.0, the last line on the twice-yearly schedule, is released28
  4. Node.js 20 Iron reaches end of life25
  5. GitHub announces npm security changes after the Shai-Hulud worm18
  6. Node.js 18 adds an experimental global fetch and the node:test module30
  7. GitHub announces that npm is joining GitHub16
  8. The Node.js Foundation and JS Foundation merge into the OpenJS Foundation22
  9. Node.js 4.0.0 reunites Node.js and io.js20
  10. Joyent announces the Node.js Foundation19
  11. Contributors fork Node.js as io.js19
  12. Ryan Dahl hands the gatekeeper role to Isaac Schlueter9
  13. Node.js 0.6.0 adds native Windows support8
  14. npm 1.0 is released15
  15. Ryan Dahl releases an early version of Node.js7

What it means for your website

On a hosted builder such as Wix, Squarespace or Shopify, you never deal with Node.js. It matters when you or a developer build, host or maintain the site’s code.

  • Find out whether your site needs Node.js live or only to build. A static site can be built with Node.js tools on a developer’s computer and then served as plain files by almost any host. A framework that renders pages on the server needs web hosting that runs Node.js itself. Next.js, for example, lists Node.js 20.9 as its minimum.33
  • Run an LTS version. The Node.js project says production apps should use Active LTS or Maintenance LTS releases.20 As of October 22, 2026, that means version 24 or 22, with 26 due to become LTS on October 28, 2026.25
  • Do not stay on an end-of-life version. Node.js 20 reached end of life on April 30, 2026, even though some tools still accept it.2533 The project warns that end-of-life versions get no more security fixes and that many packages drop support for them over time.34
  • Apply security releases. On a virtual private server you update Node.js yourself. As of October 22, 2026, the latest fixes are in 26.12.1 and 24.22.1.2627
  • Treat packages as other people’s code. Keep dependencies few, remove the ones you no longer use and ask your developer how packages are checked before they are added. The 2025 Shai-Hulud worm spread through install scripts in compromised npm packages.18
  • WordPress uses it for block development. The WordPress block editor handbook recommends installing the latest LTS version of Node.js with nvm, a version manager, on Mac and Linux before building custom blocks for a WordPress site.4

We build on WordPress every week, and our WordPress review covers what you need to run it. Our guide to how a website works shows where the server fits.

See also

References

  1. About Node.js. Node.js project, OpenJS Foundation. accessed October 22, 2026.
  2. Introduction to Node.js. Node.js project, OpenJS Foundation. accessed October 22, 2026.
  3. Usage statistics and market share of Node.js. W3Techs. 2026-10. accessed October 22, 2026.
  4. Node.js development environment. Block Editor Handbook, WordPress.org. accessed October 22, 2026.
  5. 2025 Developer Survey: Technology. Stack Overflow. 2025. accessed October 22, 2026.
  6. nodejs/node. Node.js project, GitHub. accessed October 22, 2026.
  7. The Node Ahead: JavaScript leaps from browser into future (Cade Metz). The Register. 2011-03-01. accessed October 22, 2026.
  8. Node v0.6.0. Ryan Dahl, Node.js blog. 2011-11-05. accessed October 22, 2026.
  9. New gatekeeper. Ryan Dahl, nodejs Google Group. 2012-01-30. accessed October 22, 2026.
  10. Node.js creator Ryan Dahl cedes role as gatekeeper to npm creator Isaac Schlueter. SiliconANGLE. 2012-01-30. accessed October 22, 2026.
  11. libuv. libuv project, GitHub. accessed October 22, 2026.
  12. Design overview. libuv documentation. accessed October 22, 2026.
  13. Modules: ECMAScript modules. Node.js documentation. accessed October 22, 2026.
  14. About npm. npm Docs, GitHub. accessed October 22, 2026.
  15. npm 1.0: Released. Isaac Schlueter, Node.js blog. 2011-05-01. accessed October 22, 2026.
  16. npm is joining GitHub. Nat Friedman, The GitHub Blog. 2020-03-16. accessed October 22, 2026.
  17. Express: Fast, unopinionated, minimalist web framework for Node.js. Express project, OpenJS Foundation. accessed October 22, 2026.
  18. Our plan for a more secure npm supply chain. Xavier René-Corail, The GitHub Blog. 2025-09-22. accessed October 22, 2026.
  19. Joyent: Never mind those other forkers, Node.js has a foundation now, too. The Register. 2015-02-10. accessed October 22, 2026.
  20. Node.js Releases. Node.js project, OpenJS Foundation. accessed October 22, 2026.
  21. Node.js Foundation Combines Node.js and io.js Into Single Codebase in New Release. Node.js Foundation, Node.js blog. 2015-09-14. accessed October 22, 2026.
  22. Node.js Foundation and JS Foundation Merge to Form OpenJS Foundation. The Linux Foundation. 2019-03-12. accessed October 22, 2026.
  23. Deno 1.0. Ryan Dahl, Bert Belder and Bartek Iwańczuk, Deno blog. 2020-05-13. accessed October 22, 2026.
  24. Bun 1.0. Jarred Sumner, Ashcon Partovi and Colin McDonnell, Bun blog. 2023-09-08. accessed October 22, 2026.
  25. Node.js Release Working Group: release schedule. Node.js project, GitHub. accessed October 22, 2026.
  26. Node.js 26.12.1 (Current). Antoine du Hamel, Node.js blog. 2026-10-21. accessed October 22, 2026.
  27. Node.js 24.22.1 'Krypton' (LTS). Antoine du Hamel, Node.js blog. 2026-10-21. accessed October 22, 2026.
  28. Node.js 26.0.0 (Current). Rafael Gonzaga, Node.js blog. 2026-05-05. accessed October 22, 2026.
  29. Evolving the Node.js Release Schedule. Node.js Release Working Group (NJRWG), Node.js blog. 2026-03-10. accessed October 22, 2026.
  30. Node.js 18 is now available. Node.js project, Node.js blog. 2022-04-19. accessed October 22, 2026.
  31. Permissions. Node.js documentation. accessed October 22, 2026.
  32. Modules: TypeScript. Node.js documentation. accessed October 22, 2026.
  33. Installation. Next.js documentation, Vercel. 2026-10-02. accessed October 22, 2026.
  34. End-of-Life (EOL). Node.js project, OpenJS Foundation. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].