Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. For more information on using Node.js, see the Node.js Website.

The Node.js project uses an open governance model. The Node.js Foundation provides support for the project.

This project is bound by a Code of Conduct.

• Support
• Release Types
  • Download
    • Current and LTS Releases
    • Nightly Releases
    • API Documentation
  • Verifying Binaries
• Building Node.js
• Security
• Current Project Team Members
  • TSC (Technical Steering Committee)
  • Collaborators
  • Release Team
• Contributing to Node.js

Node.js contributors have limited availability to address general support questions. Please make sure you are using a currently-supported version of Node.js.

When looking for support, please first search for your question in these venues:

• Node.js Website
• Node.js Help
• Open or closed issues in the Node.js GitHub organization

If you didn't find an answer in the resources above, try these unofficial resources:

• Questions tagged 'node.js' on StackOverflow
• #node.js channel on chat.freenode.net. See http://nodeirc.info/ for more information.
• Node.js Discord Community
• Node.js Slack Community: Visit nodeslackers.com to register.

GitHub issues are for tracking enhancements and bugs, not general support.

The open source license grants you the freedom to use Node.js. It does not guarantee commitments of other people's time. Please be respectful and manage your expectations.

• Current: Under active development. Code for the Current release is in the branch for its major version number (for example, v10.x). Node.js releases a new major version every 6 months, allowing for breaking changes. This happens in April and October every year. Releases appearing each October have a support life of 8 months. Releases appearing each April convert to LTS (see below) each October.
• LTS: Releases that receive Long-term Support, with a focus on stability and security. Every even-numbered major version will become an LTS release. LTS releases receive 18 months of Active LTS support and a further 12 months of Maintenance. LTS release lines have alphabetically-ordered codenames, beginning with v4 Argon. There are no breaking changes or feature additions, except in some special circumstances.
• Nightly: Code from the Current branch built every 24-hours when there are changes. Use with caution.

Current and LTS releases follow Semantic Versioning. A member of the Release Team signs each Current and LTS release. For more information, see the Release README.

Binaries, installers, and source tarballs are available at https://nodejs.org/en/download/.

https://nodejs.org/download/release/

The latest directory is an alias for the latest Current release. The latest-codename directory is an alias for the latest release from an LTS line. For example, the latest-carbon directory contains the latest Carbon (Node.js 8) release.

https://nodejs.org/download/nightly/

Each directory name and filename contains a date (in UTC time) and the commit SHA at the HEAD of the release.

Documentation for the latest Current release is at https://nodejs.org/api/. Version-specific documentation is available in each release directory in the docs subdirectory. Version-specific documentation is also at https://nodejs.org/download/docs/.

Download directories contain a SHASUMS256.txt file with SHA checksums for the files.

To download SHASUMS256.txt using curl:

$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt

To check that a downloaded file matches the checksum, run it through sha256sum with a command such as:

$ grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -

For Current and LTS, the GPG detached signature of SHASUMS256.txt is in SHASUMS256.txt.sig. You can use it with gpg to verify the integrity of SHASUM256.txt. You will first need to import all the GPG keys of individuals authorized to create releases. They are at the bottom of this README under Release Team. To import the keys:

$ gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D

See the bottom of this README for a full script to import active release keys.

Next, download the SHASUMS256.txt.sig for the release:

$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig

Then use gpg --verify SHASUMS256.txt.sig SHASUMS256.txt to verify the file's signature.

See BUILDING.md for instructions on how to build Node.js from source and a list of supported platforms.

Security flaws in Node.js should be reported by emailing [email protected]. Please do not disclose security bugs publicly until they have been handled by the security team.

Your email will be acknowledged within 24 hours, and you will receive a more detailed response to your email within 48 hours indicating the next steps in handling your report.

There are no hard and fast rules to determine if a bug is worth reporting as a security issue. The general rule is an issue worth reporting should allow an attacker to compromise the confidentiality, integrity, or availability of the Node.js application or its system for which the attacker does not already have the capability.

To illustrate the point, here are some examples of past issues and what the Security Response Team thinks of them. When in doubt, however, please do send us a report nonetheless.

• #14519: Internal domain function can be used to cause segfaults. Causing program termination using either the public JavaScript APIs or the private bindings layer APIs requires the ability to execute arbitrary JavaScript code, which is already the highest level of privilege possible.

• #12141: buffer: zero fill Buffer(num) by default. The buffer constructor behavior was documented, but found to be prone to mis-use. It has since been changed, but despite much debate, was not considered misuse prone enough to justify fixing in older release lines and breaking our API stability contract.

• CVE-2016-7099: Fix invalid wildcard certificate validation check. This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client.

• #5507: Fix a defect that makes the CacheBleed Attack possible. Many, though not all, OpenSSL vulnerabilities in the TLS/SSL protocols also affect Node.js.

• CVE-2016-2216: Fix defects in HTTP header parsing for requests and responses that can allow response splitting. While the impact of this vulnerability is application and network dependent, it is remotely exploitable in the HTTP protocol.

When in doubt, please do send us a report.

The Node.js project team comprises a group of core collaborators and a sub-group that forms the Technical Steering Committee (TSC) which governs the project. For more information about the governance of the Node.js project, see GOVERNANCE.md.

• addaleax - Anna Henningsen <[email protected]> (she/her)
• apapirovski - Anatoli Papirovski <[email protected]> (he/him)
• ChALkeR - Сковорода Никита Андреевич <[email protected]> (he/him)
• cjihrig - Colin Ihrig <[email protected]> (he/him)
• danbev - Daniel Bevenius <[email protected]> (he/him)
• fhinkel - Franziska Hinkelmann <[email protected]> (she/her)
• Fishrock123 - Jeremiah Senkpiel <[email protected]>
• gabrielschulhof - Gabriel Schulhof <[email protected]>
• jasnell - James M Snell <[email protected]> (he/him)
• joyeecheung - Joyee Cheung <[email protected]> (she/her)
• mcollina - Matteo Collina <[email protected]> (he/him)
• mhdawson - Michael Dawson <[email protected]> (he/him)
• MylesBorins - Myles Borins <[email protected]> (he/him)
• ofrobots - Ali Ijaz Sheikh <[email protected]> (he/him)
• rvagg - Rod Vagg <[email protected]>
• targos - Michaël Zasso <[email protected]> (he/him)
• thefourtheye - Sakthipriyan Vairamani <[email protected]> (he/him)
• TimothyGu - Tiancheng "Timothy" Gu <[email protected]> (he/him)
• Trott - Rich Trott <[email protected]> (he/him)

• bnoordhuis - Ben Noordhuis <[email protected]>
• chrisdickinson - Chris Dickinson <[email protected]>
• evanlucas - Evan Lucas <[email protected]> (he/him)
• gibfahn - Gibson Fahnestock <[email protected]> (he/him)
• indutny - Fedor Indutny <[email protected]>
• isaacs - Isaac Z. Schlueter <[email protected]>
• joshgav - Josh Gavant <[email protected]>
• mscdex - Brian White <[email protected]>
• nebrius - Bryan Hughes <[email protected]>
• orangemocha - Alexis Campailla <[email protected]>
• piscisaureus - Bert Belder <[email protected]>
• shigeki - Shigeki Ohtsu <[email protected]> (he/him)
• trevnorris - Trevor Norris <[email protected]>

• addaleax - Anna Henningsen <[email protected]> (she/her)
• ak239 - Aleksei Koziatinskii <[email protected]>
• andrasq - Andras <[email protected]>
• AndreasMadsen - Andreas Madsen <[email protected]> (he/him)
• AnnaMag - Anna M. Kedzierska <[email protected]>
• apapirovski - Anatoli Papirovski <[email protected]> (he/him)
• aqrln - Alexey Orlenko <[email protected]> (he/him)
• bcoe - Ben Coe <[email protected]> (he/him)
• bengl - Bryan English <[email protected]> (he/him)
• benjamingr - Benjamin Gruenbaum <[email protected]>
• BethGriggs - Beth Griggs <[email protected]> (she/her)
• bmeck - Bradley Farias <[email protected]>
• bmeurer - Benedikt Meurer <[email protected]>
• bnoordhuis - Ben Noordhuis <[email protected]>
• boneskull - Christopher Hiller <[email protected]> (he/him)
• brendanashworth - Brendan Ashworth <[email protected]>
• BridgeAR - Ruben Bridgewater <[email protected]> (he/him)
• bzoz - Bartosz Sosnowski <[email protected]>
• calvinmetcalf - Calvin Metcalf <[email protected]>
• ChALkeR - Сковорода Никита Андреевич <[email protected]> (he/him)
• chrisdickinson - Chris Dickinson <[email protected]>
• cjihrig - Colin Ihrig <[email protected]> (he/him)
• claudiorodriguez - Claudio Rodriguez <[email protected]>
• codebytere - Shelley Vohr <[email protected]> (she/her)
• danbev - Daniel Bevenius <[email protected]> (he/him)
• DavidCai1993 - David Cai <[email protected]> (he/him)
• davisjam - Jamie Davis <[email protected]> (he/him)
• devsnek - Gus Caplan <[email protected]> (he/him)
• digitalinfinity - Hitesh Kanwathirtha <[email protected]> (he/him)
• edsadr - Adrian Estrada <[email protected]> (he/him)
• eljefedelrodeodeljefe - Robert Jefe Lindstaedt <[email protected]>
• estliberitas - Alexander Makarenko <[email protected]>
• eugeneo - Eugene Ostroukhov <[email protected]>
• evanlucas - Evan Lucas <[email protected]> (he/him)
• fhinkel - Franziska Hinkelmann <[email protected]> (she/her)
• firedfox - Daniel Wang <[email protected]>
• Fishrock123 - Jeremiah Senkpiel <[email protected]>
• gabrielschulhof - Gabriel Schulhof <[email protected]>
• gdams - George Adams <[email protected]> (he/him)
• geek - Wyatt Preul <[email protected]>
• gibfahn - Gibson Fahnestock <[email protected]> (he/him)
• gireeshpunathil - Gireesh Punathil <[email protected]> (he/him)
• guybedford - Guy Bedford <[email protected]> (he/him)
• hashseed - Yang Guo <[email protected]> (he/him)
• hiroppy - Yuta Hiroto <[email protected]> (he/him)
• iarna - Rebecca Turner <[email protected]>
• imyller - Ilkka Myller <[email protected]>
• indutny - Fedor Indutny <[email protected]>
• italoacasas - Italo A. Casas <[email protected]> (he/him)
• JacksonTian - Jackson Tian <[email protected]>
• jasnell - James M Snell <[email protected]> (he/him)
• jasongin - Jason Ginchereau <[email protected]>
• jbergstroem - Johan Bergström <[email protected]>
• jdalton - John-David Dalton <[email protected]>
• jhamhader - Yuval Brik <[email protected]>
• jkrems - Jan Krems <[email protected]> (he/him)
• joaocgreis - João Reis <[email protected]>
• joshgav - Josh Gavant <[email protected]>
• joyeecheung - Joyee Cheung <[email protected]> (she/her)
• julianduque - Julian Duque <[email protected]> (he/him)
• JungMinu - Minwoo Jung <[email protected]> (he/him)
• kfarnung - Kyle Farnung <[email protected]> (he/him)
• kunalspathak - Kunal Pathak <[email protected]>
• lance - Lance Ball <[email protected]> (he/him)
• Leko - Shingo Inoue <[email protected]> (he/him)
• lpinca - Luigi Pinca <[email protected]> (he/him)
• lucamaraschi - Luca Maraschi <[email protected]> (he/him)
• lundibundi - Denys Otrishko <[email protected]> (he/him)
• maclover7 - Jon Moss <[email protected]> (he/him)
• mafintosh Mathias Buus <[email protected]> (he/him)
• mcollina - Matteo Collina <[email protected]> (he/him)
• mhdawson - Michael Dawson <[email protected]> (he/him)
• misterdjules - Julien Gilli <[email protected]>
• mmarchini - Matheus Marchini <[email protected]>
• MoonBall - Chen Gang <[email protected]>
• mscdex - Brian White <[email protected]>
• MylesBorins - Myles Borins <[email protected]> (he/him)
• not-an-aardvark - Teddy Katz <[email protected]> (he/him)
• ofrobots - Ali Ijaz Sheikh <[email protected]> (he/him)
• orangemocha - Alexis Campailla <[email protected]>
• othiym23 - Forrest L Norvell <[email protected]> (he/him)
• phillipj - Phillip Johnsen <[email protected]>
• pmq20 - Minqi Pan <[email protected]>
• princejwesley - Prince John Wesley <[email protected]>
• Qard - Stephen Belanger <[email protected]> (he/him)
• refack - Refael Ackermann <[email protected]> (he/him)
• richardlau - Richard Lau <[email protected]>
• ronkorving - Ron Korving <[email protected]>
• RReverser - Ingvar Stepanyan <[email protected]>
• rubys - Sam Ruby <[email protected]>
• rvagg - Rod Vagg <[email protected]>
• ryzokuken - Ujjwal Sharma <[email protected]> (he/him)
• saghul - Saúl Ibarra Corretgé <[email protected]>
• sam-github - Sam Roberts <[email protected]>
• santigimeno - Santiago Gimeno <[email protected]>
• sebdeckers - Sebastiaan Deckers <[email protected]>
• seishun - Nikolai Vavilov <[email protected]>
• shigeki - Shigeki Ohtsu <[email protected]> (he/him)
• silverwind - Roman Reiss <[email protected]>
• srl295 - Steven R Loomis <[email protected]>
• starkwang - Weijia Wang <[email protected]>
• stefanmb - Stefan Budeanu <[email protected]>
• targos - Michaël Zasso <[email protected]> (he/him)
• thefourtheye - Sakthipriyan Vairamani <[email protected]> (he/him)
• thekemkid - Glen Keane <[email protected]> (he/him)
• thlorenz - Thorsten Lorenz <[email protected]>
• TimothyGu - Tiancheng "Timothy" Gu <[email protected]> (he/him)
• tniessen - Tobias Nießen <[email protected]>
• trevnorris - Trevor Norris <[email protected]>
• trivikr - Trivikram Kamat <[email protected]>
• Trott - Rich Trott <[email protected]> (he/him)
• vdeturckheim - Vladimir de Turckheim <[email protected]> (he/him)
• vkurchatkin - Vladimir Kurchatkin <[email protected]>
• vsemozhetbyt - Vse Mozhet Byt <[email protected]> (he/him)
• watilde - Daijiro Wachi <[email protected]> (he/him)
• watson - Thomas Watson <[email protected]>
• whitlockjc - Jeremy Whitlock <[email protected]>
• XadillaX - Khaidi Chu <[email protected]> (he/him)
• yhwang - Yihong Wang <[email protected]>
• yorkie - Yorkie Liu <[email protected]>
• yosuke-furukawa - Yosuke Furukawa <[email protected]>

• imran-iq - Imran Iqbal <[email protected]>
• isaacs - Isaac Z. Schlueter <[email protected]>
• lxe - Aleksey Smolenchuk <[email protected]>
• matthewloring - Matthew Loring <[email protected]>
• micnic - Nicu Micleușanu <[email protected]> (he/him)
• mikeal - Mikeal Rogers <[email protected]>
• monsanto - Christopher Monsanto <[email protected]>
• Olegas - Oleg Elifantiev <[email protected]>
• petkaantonov - Petka Antonov <[email protected]>
• piscisaureus - Bert Belder <[email protected]>
• rlidwka - Alex Kocharin <[email protected]>
• rmg - Ryan Graham <[email protected]>
• robertkowalski - Robert Kowalski <[email protected]>
• romankl - Roman Klauke <[email protected]>
• tellnes - Christian Tellnes <[email protected]>
• tunniclm - Mike Tunnicliffe <[email protected]>

Collaborators follow the COLLABORATOR_GUIDE.md in maintaining the Node.js project.

Node.js releases are signed with one of the following GPG keys:

• Colin Ihrig <[email protected]> 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
• Evan Lucas <[email protected]> B9AE9905FFD7803F25714661B63B535A4C206CA9
• Gibson Fahnestock <[email protected]> 77984A986EBC2AA786BC0F66B01FBB92821C587A
• James M Snell <[email protected]> 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
• Jeremiah Senkpiel <[email protected]> FD3A5288F042B6850C66B31F09FE44734EB7990E
• Michaël Zasso <[email protected]> 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
• Myles Borins <[email protected]> C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
• Rod Vagg <[email protected]> DD8F2338BAE7501E3DD5AC78C273792F7D83545D

The full set of trusted release keys can be imported by running:

gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
gpg --keyserver pool.sks-keyservers.net --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9
gpg --keyserver pool.sks-keyservers.net --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A
gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
gpg --keyserver pool.sks-keyservers.net --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E
gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D

See the section above on Verifying Binaries for how to use these keys to verify a downloaded file.

Previous releases may also have been signed with one of the following GPG keys:

• Chris Dickinson <[email protected]> 9554F04D7259F04124DE6B476D5A82AC7E37093B
• Isaac Z. Schlueter <[email protected]> 93C7E9E91B49E432C2F75674B0A78B0A6C481CF6
• Italo A. Casas <[email protected]> 56730D5401028683275BD23C23EFEFE93C4CFFFE
• Julien Gilli <[email protected]> 114F43EE0176B71C7BC219DD50A3051F888C628D
• Timothy J Fontaine <[email protected]> 7937DFD2AB06298B2293C3187D33FF9D0246406D

• Contributing to the project
• Working Groups
• Strategic Initiatives