The State of Node.js 2025

Hello, everyone! I'm Matteo Collina, and today we are going to chat about the state of Node.js. Thanks to the folks at JS Nation for organizing JS Nation US. I'm so sorry to not be able to be there in person, but this is the updated version of the talk that I did in June in Amsterdam. So, you know, enjoy.

First of all, who I am? Co-founder and CTO of a startup called Platformatic. I'm also the chair of the Node.js Tying and Steering Committee, board member of both the OpenJS and GraphQL foundations, creator of a lot of open source, including Fastify and Pino. I have a newsletter, nodeland.dev. You can check it out. But, you know, all of you are using my software, so... Nope, it's not working.

Okay. Okay, sorry. It was not working. Okay, I'm starting from scratch. Okay. Hi, everyone. I'm Matteo Collina, Platformatic co-founder and CTO, but more importantly, chair of the Node.js Tying and Steering Committee. And today I am here to talk about the state of Node.js. This talk is updated at November 2025. So, you know, quite recent probably. I'm also board member of the OpenJS and GraphQL foundations, as well as I have created a bunch of open source, including Fastify, Pino. And, you know, I also have a newsletter where I write every now and then, nodeland.dev. You're all using my software. Last year my software has been downloaded 30 billion times on MPM, plus the Downloads of a Node, which we're going to talk about in a second. This talk is all about to, you know, dismiss some myths. Okay, and the myths are, you know, when you hear this phrase of XYZ will destroy Node.js or ZYX will flip the default Big Can JavaScript runtime from Node.js. You have heard those sentences every single time. Okay. I want to dismiss this basic question that some people are asking. And they've asked me all the time.

So I tend to respond now and, you know, tend to give this talk to answer this question specifically. Is Node.js dead yet? Okay. Well, no, it's not. It's not dead. Actually, it's thriving. That's going through the numbers. Okay. But before we go there, let me tell you a secret. Okay. You know that there is a technology that was born in 1959 that is back on the raise. Do you know? Well, come on, it's COBOL. COBOL is growing, is on the raise. Okay. To be honest, Scratch is over, but, you know, it's still just under rust. Okay. Come on, it's COBOL, you know. Huh.

Also, jQuery, which is, you know, probably not how we write websites today. Okay. It's still powering the majority of the web way more than React. Okay. But everybody's talking about React. Okay. And, you know, for good reason. Okay. But, you know, to put things in perspective, you know, technologies, once they reach a certain stage, they don't die. Okay. There's nothing that can be destroyed. Okay. At all.

In fact, Node.js is the most popular, is one of the most popular technologies, according to Stack Overflow. So in 2024. Okay. There's a new survey that's probably going to be out sooner rather than later. Also, a lot of other people are asked if Node.js and NPM should be bundled together or not. And, you know, to be honest, I think, yes, it was a combo. Okay. Node.js plus NPM. And that solved software reuse at scale. And nobody, no other system did. And, you know, what problems Node.js and NPM fixed is auto-reuse software at a scale that was never tried before. And it comes with all the problems. But, you know, like a black hole. But, you know, it's okay.

Also, module usage is also grew. Okay. Readable stream, which is one of the most downloaded modules on NPM, keeps growing. It's downloaded, I don't know, seven billion times per year or something. It's incredible. Now, a very interesting measure, though, is the type of operating systems and binaries that are being downloaded from Node.js. Okay. By the way, Node.js, more or less, today as of October, it's being downloaded 400 million times per month, more or less, overall. And half of those things are headers. When are headers being downloaded? Well, headers are being downloaded when you need to compile a native add-on.

Now, then a good chunk of Node users are Linux systems. Why? Well, it's CI, okay, probably. Then a very second good big, big, big, big user is Windows. A lot of Windows users of Node.js are out there. Okay.

Okay. And then last but not least, there is Mac OS. So very interesting numbers. In fact, all of Node.js downloads clocked at 271 million monthly downloads last December to 403 million in October. So you can see the progression and how much more Node.js is being downloaded. So probably you're building a system of Node.js and not updating, essentially, and keep downloading old versions.

In fact, there is still... Oh, yeah, this is missing an N1. Okay. Typo. Okay. Fantastic. Sorry about this. This is one. Okay. This is 18. Okay. And Node.js 18, 16, 14, and 12 are massively popular while they still have known vulnerabilities. And you can see them, but it's still being downloaded a lot. Like, you know, Node 18 is still downloaded. This is just missing an N1. This has been downloaded 40 million times per month. Now what? Maybe 30 million times per month. And 16 still out there. 12 still out there. All of those are very old and you're not updating.

Yeah, you're not updating Node.js. And you're putting yourself at risk. Ouch! Okay.

Ouch! Okay. This is the traditional long-term support schedule of Node.js. Today it's October, well, it's actually November. Okay. And Node.js 24 is now entering its active long-term support phase. Okay. And it's actually very interesting that it's overlapped with Node.js 22 in this period. Okay.

Then after that it starts the maintenance phase, which is what Node.js 22 sooner will go into, which will not get any new features, essentially. And Node.js 20 is already in maintenance and will go out of support in April 2026. Wow. Look, Node 20 is still the new thing, mostly for some companies, and it's almost out of support. Okay.

Yeah. As I said, we are releasing new Node.js. New people are using Node.js everywhere, but old projects are not being updated. Okay. Let me show you the downloads. This is actually another view of the downloads numbers. And we can see that Node.js 22 is the most downloaded Node.js version, essentially. And most teams update their Node.js version every two LTS releases. It has this bimodal thing, you know. There's Node.js 16. Okay. And Node.js 18 started to pick up when Node.js 16 went out of LTS, when Node.js 18 went LTS. Okay. Then when Node.js 20 went LTS, you can see the knob, you can see how it's going. Okay. It's the peak keeps going up. And the numbers are incredible with Node 20.

Node 20 had a massive adoption. And Node 22 added up on top of that. Okay. So and you can see that Node 22 essentially has reduced the Node 18 downloads, essentially. So people jumped from Node 18 to Node 22, essentially. Pretty cool. Okay. Numbers of the conditional activity went very well. Okay. Still, everything is pretty good.

This is a nice website, NextHouseInsights. Okay. Everything is still pretty good. And we are getting a lot of comments and push history and so on and so forth. Number of requests is going strong, and so on and so forth. At Node.js we work hard to keep you safe. Okay. And this is the data from last year of the number of submissions. Then for next year, I will produce them again. It's basically submissions are what we receive. The number of entries we receive in our security report program, you can see here we have a number of submissions are very high. Okay.

And we receive between 20 and 30 more or less per quarter. All of these is silent work that volunteers have been doing to keep you all safe. The average time to first response is very low. It's typically between less than a day. Typically, somebody says, well, we are looking into it. Start asking questions to the reporter. Okay. Then the actual time to triage, which means assessing if and when something is a vulnerability or not, it's still a few days.

Okay, pretty good. Note that Node.js got some budget from the Alpha Omega project, and both in 2022, 2023, 2024 and 2025, a little bit less for funding some security work on the project. So, Node 24, as long time support, you should be using these now.

What are the greatest features of Node 24? First and foremost, if you haven't used it yet, you can require any ESM module now. So this was one of the most requested features ever of Node.js, and you should be using it today. Also, Node.js is not needed anymore and for similar reason, you can just write Node.js file.

If you include ECMAScript module syntax, it will just work. It will say that it's slower, blah, blah, blah, but it will work. But way more importantly, it will run TypeScript out of the box and without the warning. Also, async local storage now is implemented via V8 async context frame. This means that you get significant more performance out of it. There is a stable permission system that you can use to control if your process has access or not to specific folders.

And you can just write TypeScript and it will just be executed out of the box. This is based on the concept of type stripping. So all the types are going to be replaced to whitespaces. So some of the things are not supported without additional flags, but it's great.

Also, async local storage now is implemented via V8 async context frame. This means that you get significant more performance out of it. And maybe a 7.4% as I benchmarked some time ago. It's pretty great. What does it mention? Well, it's relevant for your observability needs.

Then we have using, which is supported. You can just implement symbol.asyncDispose and start using using. This is one of my most interesting syntax. There is a stable permission system that you can use to control if your process has access or not to specific folders. This is actually very interesting because it allows another level of protection to your system.

Okay. This is actually very interesting because it allows another level of protection to your system.

Now, question for you. Are you using the latest Node.js features or a stick stack in 2015? Well, Node.js is not always relaxing because we need you. Let me talk a little bit about how the process is governed and why we say we need you. We need you to contribute. We need you to start working with us.

Node.js is a project within the purview of the OpenJS Foundation, holds 30 plus other projects, including Webpack, ESLint, Electron, jQuery, a lot, right? And plenty more. Express. Let's talk about the Node.js collaborators. Node.js collaborators, core collaborators, maintain the Node.js slash Node repositories. And typically, those collaborators have access to the Node.js, have the commit access, and they can start CI. And the important part is two collaborators must approve any pull requests before it lands. And it does not need to have any blockers.

Okay. If there is a block, somebody needs to go to, and it can be resolved with discussion. Okay. This needs to go to the TSC, the Technical Steering Committee, which has the power to override that objection via a vote. Typically, the TSC prefers to let the users, the collaborators, figure it out on their own. But, you know, we have voted in a lot of cases. What does the TSC does? The TSC sets the release dates, and also quality standards, provides some level of technical direction. And one of the most important ones is the maintaining the list of collaborators. Okay. As well as all other things. TSC, the role of the Technical Steering Committee is to vote.

Okay. In case there is a disagreement. And typically, the most important part of all of this is that no more than one fourth of the Technical Steering Committee could be affiliated with the same employer. So what does it mean? It means that no one can control Node.js. This drives a few people mad. So you cannot force Node.js in a direction where the Technical Steering Committee is not involved in approving. And you cannot control it. This means that typically each collaborator has to compromise to achieve his objective. And it's a true volunteer-driven organization. So if you have a problem with Node.js, the best part is start contributing. If you are a developer, you can probably help in the maintenance.

Okay. So, you know, just start. Now, before we go, I have a few goodies for you. Okay. Let's go with them. We'll go with the first one. The first one is the Definite Guide for Node.js in Enterprise. Okay. It's an ebook that we've wrote. You can check it out. This is the QR code. Okay. And it just works. Okay. The second goodie is a little bit of self-promotion. This is Platformatic VAT, is the application server for Node.js. It does quite a few interesting things. It provides you threads, multi-threading. It allows to run multiple Node.js applications as different threads inside the same process.

This gives you a lot of benefits without changing your app, including multi-threading, graceful shutdowns, caching, logs, a lot of those things. So you might want to check it out.

Fortunately, I don't have time for the demo. But you know, I would be back.

And with that, thank you very much, folks. This has been a pleasure. And I have... I'm sorry you couldn't meet me in New York. But, you know, hey! Bye, guys. Bye-bye-bye-bye-bye-bye-bye. Thank you.