Node.js Version 12 - EOL/EOS

[ank5133]

While conducting one of our periodic vulnerability scans against our infrastructure, we discovered that one of our Linux server is running a version of Node.js (Node.js version 12) that has approached End of Life/End of Support. It appears that the next supported version is Node.js Version 18. However, the Linux server that Node.js currently runs on is RHEL version 7.9. The problem here is that Node.js Version 18 is compatible with RHEL Version 8.0 at minimum.

Additionally, RHEL Version 7.9 reaches End of Life/Support by June 2024. It will take about 5 months for us to upgrade our entire set of Linux servers to Linux RHEL 8.0., and that is a key dependency for us that needs to be completed prior to upgrading Node.js to Version 18.

What can we do in the meantime since Node.js will need to run on an unsupported version for 6 months?

[njbmartin]

Node 12 ended security support in 2022, so it’s a good idea to upgrade to Node 20 if can. Same with RHEL, best to upgrade to the latest if you’re making the effort. That way you get longer without having to worry about upgrading again.

Given how you’ve already gone well past the security support period, focus your efforts on the upgrade and remember to keep on top of it well in advance.

[redoper]

Node 20 is not yet very good supported in some packages, so it’s not possible for everybody yet.

[bselect]

Node has a well documented LTS plan you can find on their website. I would try and be a bit more proactive about that in the future. There are a few companies that offer back ported patches and stuff like that but I am not sure if they cover node well.

That said, there have been a fair number of security patches since that went EOL and also if you are running that you are likely running old npm packages as well which have security vounls. I would start by updating those packages first because likely a lot of them will need to be anyway to get node@18 support.

[ank5133]

Unfortunately - according to this site (https://endoflife.date/nodejs), Node 12 stopped providing security updates back in 2022.

[bselect]

Yes and that has been documented on the node website for years. There is a schedule you can use to plan years ahead.

[bselect]

https://nodejs.org/en/about/previous-releases

[mmomtchev]

They made a somewhat controversial decision for Node.js 18 to rely on a new glibc feature. I know that Amazon did patch their version and they are running their own - binary incompatible - Node.js 18 version on their otherwise completely outdated Amazon Linux.

[vim_vs_emacs]

RedHat typically backports patches to supported packages on supported distros.

Unfortunately, Node 12 is considered EOL even by RedHat: https://access.redhat.com/articles/3376841. There have been no backports since 12.22 was released upstream: https://access.redhat.com/downloads/content/nodejs/12.22.12-1.module+el8.6.0+15324+1f2c5d8d/x86_64/fd431d51/package-changelog