About Node.js 18
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Notable Changes
This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.
Commits
- [f737a79073] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #51501
- [fce923ba69] - build: update gcovr to 7.2 and codecov config (Benjamin E. Coe) #54019
- [8b7ffd807c] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
- [ee9a343413] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
- [738bf8aea4] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681
- [69d661d591] - deps: update undici to v5.29.0 (Matteo Collina) #57557
- [59fcf43b0e] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
- [1b72869503] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #57335
- [a566560235] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #57335
- [50c4e1da2f] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #57384
- [c3babb4671] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #57104
- [784da606a6] - doc: fix link and history of SourceMap sections (Antoine du Hamel) #57098
- [f5dbceccbe] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #56420
| Publisher | Node.js Foundation |
|---|---|
| Author | OpenJS Foundation |
| Version | 18.20.8 |
| Release date | 2025-03-27 |
| License | MIT |
| Installer type | wix, zip |
| Architecture | x86, x64 |
| Package ID | OpenJS.NodeJS.18 |
| Admin rights | Required |
| Install scope | All users |
winget install --id=OpenJS.NodeJS.18 -ewinget upgrade --id=OpenJS.NodeJS.18 -ewinget uninstall --id=OpenJS.NodeJS.18 -emsiexec /i "node-v18.20.8-x64.msi" /quiet /norestartmsiexec /x {CC48A89B-2866-40B4-8B58-3DEFB1F2643E} /quietNode.js 18 adds these commands to the command line: corepack, node, npm, npx.
Node.js 18 can open or be associated with 3 file types:
Notable Changes
- [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
Commits
- [bb2977ca6c] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
- [92896945b8] - build: support python 3.13 (Chengzhong Wu) #53190
- [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
- [d03a23577d] - deps: V8: cherry-pick 26fd1dfa9cd6 (Shu-yu Guo) #55873
- [53bb21b093] - deps: V8: backport ae5a4db8ad86 (Shu-yu Guo) #55873
- [5eb6dfe284] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #55980
- [734515a0f7] - deps: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) #54432
- [d64cc98324] - deps: update simdutf to 5.6.4 (Node.js GitHub Bot) #56255
- [9eab21dd1d] - deps: update simdutf to 5.6.3 (Node.js GitHub Bot) #55973
- [2e3367b46a] - deps: update simdutf to 5.6.2 (Node.js GitHub Bot) #55889
- [df74d66207] - deps: update simdutf to 5.6.1 (Node.js GitHub Bot) #55850
- [ade37ee0b3] - deps: update acorn to 8.14.0 (Node.js GitHub Bot) #55699
- [a3c367adbd] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #56795
- [2cff6a8428] - deps: update corepack to 0.30.0 (Node.js GitHub Bot) #55977
- [8b8c9a2cf5] - doc: update macOS and Xcode versions for releases (Michaël Zasso) #56337
- [706af28113] - doc: add "Skip to content" button (Antoine du Hamel) #56750
- [634a6b3a14] - doc: improve accessibility of expandable lists (Antoine du Hamel) #56749 …
This is a security release.
Notable Changes
- CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
- CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
- CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Commits
- [c03ad5ed63] - build: use rclone instead of aws CLI (Michaël Zasso) #55617
- [8232463294] - build, tools: drop leading / from r2dir (Richard Lau) #53951
- [b26bcd3394] - build, tools: copy release assets to staging R2 bucket once built (flakey5) #51394
- [56df127b7b] - build,tools: simplify upload of shasum signatures (Michaël Zasso) #53892
- [a63e9372ed] - (CVE-2025-22150) deps: update undici to v5.28.5 (Matteo Collina) nodejs-private/node-private#657
- [da2d177f91] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
- [6cc8d58e6f] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
Notable Changes
- [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #55333
Commits
- [c2e6a8f215] - benchmark: fix napi/ref addon (Michaël Zasso) #53233
- [4c2e07aaac] - build: pin doc workflow to Node.js 20 (Richard Lau) #55755
- [6ba4ebd060] - build: fix build with Python 3.12 (Luigi Pinca) #50582
- [c50f01399e] - crypto: ensure invalid SubtleCrypto JWK data import results in DataError (Filip Skokan) #55041
- [5c46782137] - crypto: make deriveBits length parameter optional and nullable (Filip Skokan) #53601
- [6e7274fa53] - crypto: reject dh,x25519,x448 in {Sign,Verify}Final (Huáng Jùnliàng) #53774
- [d2442044db] - crypto: reject Ed25519/Ed448 in Sign/Verify prototypes (Filip Skokan) #52340
- [93670de499] - deps: upgrade npm to 10.8.2 (npm team) #53799
- [8531c95587] - deps: upgrade npm to 10.8.1 (npm team) #53207
- [fd9933ea0f] - deps: upgrade npm to 10.8.0 (npm team) #53014
- [03852495d7] - deps: update simdutf to 5.6.0 (Node.js GitHub Bot) #55379
- [3597be4146] - deps: update simdutf to 5.5.0 (Node.js GitHub Bot) #54434
- [52d2c03738] - deps: update simdutf to 5.3.4 (Node.js GitHub Bot) #54312
- [dd882ac483] - deps: update simdutf to 5.3.1 (Node.js GitHub Bot) #54196
- [5fb8e1b428] - deps: update simdutf to 5.3.0 (Node.js GitHub Bot) #53837
- [c952fd886d] - deps: update simdutf to 5.2.8 (Node.js GitHub Bot) #52727
- [a1ae050ed5] - deps: update simdutf to 5.2.6 (Node.js GitHub Bot) #52727 …
Yes. Node.js 18 is free and open-source software released under the MIT license.
The latest version is 18.20.8, released on Mar 27, 2025.
The download button links to the official installer published on nodejs.org, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with bd8b92343e12dbe9e573d2f5d5fec6953fcf12e00add58a29a6774391d02f342.
Node.js 18 runs on Windows and is available for 32-bit (x86), 64-bit (x64) systems.
Run the offline installer with msiexec /i "node-v18.20.8-x64.msi" /quiet /norestart, or install it with Windows Package Manager: winget install --id=OpenJS.NodeJS.18 -e --silent.
Open Settings › Apps › Installed apps, find Node.js 18 and select Uninstall. From the command line, run winget uninstall --id=OpenJS.NodeJS.18 -e.
Node.js 18 supports 3 file types, including .cjs, .js, .mjs.