Node.js 24 Is Now LTS: Upgrade Now or Set a Date

Node.js 24.21.0 ‘Krypton’ entered Long-Term Support on September 8. The wait-and-see period is over. If you’re running Node 22 — or worse, Node 20 — you now have a firm deadline and a runtime that’s meaningfully better. Here’s what changed, what breaks, and what to do this week.

The Big Win: Explicit Resource Management

The headline feature of Node 24 isn’t a new HTTP method or a CLI flag — it’s a language primitive that should have existed five years ago. V8 13.6 ships Explicit Resource Management: the using and await using keywords from the TC39 proposal.

In plain terms: when a block exits — whether normally or via a thrown error — cleanup runs automatically. No more try/finally boilerplate wrapping every database connection and file handle.

// Before Node 24
let conn;
try {
  conn = await db.connect();
  await conn.query(‘SELECT 1’);
} finally {
  conn?.close();
}

// Node 24: using keyword handles cleanup automatically
await using conn = await db.connect();
await conn.query(‘SELECT 1’);
// conn.close() called automatically, even on throw

This works via Symbol.dispose and Symbol.asyncDispose — meaning any object can opt in. Expect framework authors to adopt this across the ecosystem over the next few months. Node.js finally has the cleanup primitive that Python’s with statement has offered since 2.5.

The Silent Breaker: OpenSSL 3.5

Here’s the one that will catch teams off guard. Node 24 ships with OpenSSL 3.5, and the default security level is now 2. That means any RSA, DSA, or DH key under 2048 bits is rejected. Any ECC key under 224 bits is rejected. Silently, at runtime.

If your TLS config was last touched in 2016, this is your debt collection notice.

The crypto upgrades aren’t all bad news. The same release adds a STORE loader for hardware security modules — meaning AWS KMS, Azure Key Vault, and GCP Cloud KMS can now feed private keys directly into Node’s crypto stack without third-party wrappers. For teams running in compliance-heavy environments, this is a significant quality-of-life improvement that doesn’t get enough attention.

V8 13.6: The Rest of the Wins

Explicit resource management gets the headline, but V8 13.6 brings several other language-level upgrades worth noting:

• Float16Array — 16-bit floating point typed array. Half the memory footprint of Float32Array. If you’re co-locating ML inference in a Node backend, or working with GPU pipelines, this matters. The browser has had it since Chrome 122; Node is finally aligned.
• RegExp.escape() — RegExp.escape(str) returns a safely escaped string. One less custom utility function, one fewer regex injection vector.
• Error.isError() — A reliable cross-realm error check that actually works. Every Node developer has hit the cross-realm instanceof edge case at least once.
• WebAssembly Memory64 — 64-bit memory addressing for WASM. Large AI models and data pipelines that previously ran into the 4GB WASM memory limit can now run directly.

Also shipping: AsyncLocalStorage now uses AsyncContextFrame by default, which improves performance for frameworks that depend heavily on async context tracking — OpenTelemetry instrumentation, NestJS interceptors, Express middleware chains.

npm 11 and the Practical Migration

Node 24 bundles npm 11. The changes are mostly welcome — improved peer dependency resolution, stricter lockfile handling — but workspace configurations that worked fine in npm 10 may need adjustments. Budget 30 minutes to check.

The broader migration from Node 22 to Node 24 LTS is well-documented, with NodeSource confirming it’s “the smoothest major upgrade in years.” Typical effort runs from half a day to three days, depending on native module dependencies.

Key things to audit before you cut over:

• Native modules — rebuild against the Node 24 ABI
• TLS key lengths — OpenSSL 3.5 strict mode rejects short keys at runtime
• Deprecated API usage — url.parse, tls.createSecurePair, and SlowBuffer are gone
• Windows developers — MSVC support dropped; ClangCL now required for native compilation
• Dockerfiles — update base image to FROM node:24-alpine or FROM node:24-slim

The Deadlines

This is the part that should focus minds. Check the Node.js end-of-life schedule and then look at what version you’re running in production:

• Node 18: Already past EOL. Running this in production is a security liability.
• Node 20: EOL October 2026 — one month from today.
• Node 22: EOL April 2027 — start planning now.
• Node 24 LTS: Supported through April 2028.

Node 24 already led download rankings across all versions — 358.8 million monthly downloads — before it even reached LTS status. The ecosystem has made its choice.

Bottom Line

If you’re on Node 18 or 20, this is urgent. If you’re on Node 22, LTS promotion is your scheduling trigger. Node 24 is a genuinely good release — explicit resource management alone is worth the migration cost, and the OpenSSL 3.5 changes will matter more than most teams realize until they hit them in production. Check the Node 22 to 24 migration guide and block out time on the calendar.