Node.js 20 20.20.2

Run JavaScript Everywhere

By Node.js Foundation
Open Source
Updated Mar 24, 2026

About Node.js 20

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

What's new in 20.20.2

This is a security release.
Notable Changes
- (CVE-2026-21717) fix array index hash collision (Joyee Cheung) https://github.com/nodejs-private/node-private/pull/834
- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) https://github.com/nodejs-private/node-private/pull/822
- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) https://github.com/nodejs-private/node-private/pull/821
- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) https://github.com/nodejs-private/node-private/pull/795
- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) https://github.com/nodejs-private/node-private/pull/794
- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) https://github.com/nodejs-private/node-private/pull/832
- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) https://github.com/nodejs-private/node-private/pull/819
Commits
- [cfb51fa9ce] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#831
- [f333d0be5f] - deps: V8: override depot_tools version (Richard Lau) #62344
- [2acd5d1226] - deps: update undici to v6.24.1 (Matteo Collina) #62285
- [af5c144ebc] - (CVE-2026-21717) deps,build,test: fix array index hash collision (Joyee Cheung) nodejs-private/node-private#834
- [00ad47a28e] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
- [0123309566] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#840
- [00830712bc] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#838
- [a0c73425da] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
- [cc3f294507] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#839

Full release notes »

Technical details

Publisher	Node.js Foundation
Author	OpenJS Foundation
Version	20.20.2
Release date	2026-03-24
License	MIT
Installer type	wix, zip
Architecture	x86, x64, arm64
Package ID	OpenJS.NodeJS.20
Admin rights	Required
Install scope	All users

Install Node.js 20 from the command line

Install with Windows Package Manager

winget install --id=OpenJS.NodeJS.20 -e

Update to the latest version

winget upgrade --id=OpenJS.NodeJS.20 -e

Uninstall

winget uninstall --id=OpenJS.NodeJS.20 -e

Silent install with the offline installer

msiexec /i "node-v20.20.2-x64.msi" /quiet /norestart

Uninstall the MSI package

msiexec /x {EC1CD587-CC41-4B29-9D2C-CD8067FA1341} /quiet

Node.js 20 adds these commands to the command line: corepack, node, npm, npx.

codingcross-platformdevelopdevelopmentenvironmentjavascriptjsltsnodenpmprogrammingruntimev8

File types supported by Node.js 20

Node.js 20 can open or be associated with 3 file types:

.cjs.js.mjs

Node.js 20 version history

20.20.1 Mar 4, 2026

Notable Changes
- [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
- [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
- [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
Commits
- [6f580d5399] - assert: fix deepEqual always return true on URL (Xuguang Mei) #50853
- [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
- [cc4f7af6f3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790
- [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
- [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
- [fa88cc07e2] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
- [88b2eec88a] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #61830
- [5c053264f1] - deps: V8: backport 6a0a25abaed3 (Vivian Wang) #61687
- [4a398699d0] - deps: update googletest to 5a9c3f9e8d9b90bbbe8feb32902146cb8f7c1757 (Node.js GitHub Bot) #61731
- [4fa43adf15] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605
- [1a855d490c] - deps: update googletest to 85087857ad10bd407cd6ed2f52f7ea9752db621f (Node.js GitHub Bot) #61417
- [d8a9359826] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523
- [e79cd3a0bb] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928 …

20.20.0 Jan 12, 2026

This is a security release.
Notable Changes
lib:
- (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802
- (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
lib,permission:
- (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
src:
- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:
- (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796
Commits
- [8f9ba3f623] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
- [97fc9b0eb7] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#792
- [14fbbb510c] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#802
- [1febc48d5b] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
- [494f62dc23] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760 …

20.19.6 Nov 25, 2025

Notable Changes
- [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
- [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
- [db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313
Commits
- [0f644df42e] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #59547
- [fba0025b9c] - build: use windows-2025 runner (Michaël Zasso) #59673
- [3456ec946d] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956
- [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
- [1788fb5f3d] - deps: update undici to 6.22.0 (Matteo Collina) #60112
- [5d61b55f24] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #59791
- [9f1e5e4637] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #59689
- [d0edb01d25] - deps: update googletest to eb2d85e (Node.js GitHub Bot) #59335
- [576242ff39] - deps: V8: cherry-pick a0d0d4fc4f19 (Ho Cheung) #60716
- [a07a277020] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314
- [fa5c5af8ce] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
- [556113e2fc] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
- [cd1536ca90] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
- [acec79989e] - deps: V8: cherry-pick 6b1b9bca2a8 (zhoumingtao) #59283 …

Other versions

20.19.5
20.19.4
20.19.3
20.19.2
20.19.1
20.19.0

Frequently asked questions

Is Node.js 20 free?

Yes. Node.js 20 is free and open-source software released under the MIT license.

What is the latest version of Node.js 20?

The latest version is 20.20.2, released on Mar 24, 2026.

Is it safe to download Node.js 20?

The download button links to the official installer published on nodejs.org, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with 9a283dcdb771793d6492235e81f3fc80048db8a37497a0af87b0a9f450d10fa6.

Which Windows versions does Node.js 20 support?

Node.js 20 runs on Windows and is available for 32-bit (x86), 64-bit (x64), ARM64 systems.

How do I install Node.js 20 silently?

Run the offline installer with msiexec /i "node-v20.20.2-x64.msi" /quiet /norestart, or install it with Windows Package Manager: winget install --id=OpenJS.NodeJS.20 -e --silent.

How do I uninstall Node.js 20?

Open Settings › Apps › Installed apps, find Node.js 20 and select Uninstall. From the command line, run winget uninstall --id=OpenJS.NodeJS.20 -e.

What file types can Node.js 20 open?

Node.js 20 supports 3 file types, including .cjs, .js, .mjs.

Node.js 20 20.20.2

About Node.js 20

What's new in 20.20.2

Technical details

Install Node.js 20 from the command line

File types supported by Node.js 20

Node.js 20 version history

Other versions

Frequently asked questions

Is Node.js 20 free?

What is the latest version of Node.js 20?

Is it safe to download Node.js 20?

Which Windows versions does Node.js 20 support?

How do I install Node.js 20 silently?

How do I uninstall Node.js 20?

What file types can Node.js 20 open?

Alternatives to Node.js 20

Deno 2.9.8

Volta 2.0.2

PhpStorm 2026.2.3

WebStorm 2026.2.3

kdevelop 5.5.0

RustRover 2026.2.4

More from Node.js Foundation

Node.js 26.12.1

Node.js 10 10.24.1

Node.js 12 12.22.12

Node.js 14 14.21.3