Custom Node.js development for APIs and real-time products

Node.js in 2026: versions, frameworks, security and cost

This guide is for founders and CTOs deciding whether to build on Node.js, which version and framework to choose, and what a sensible engagement looks like. Every version and date below was checked in October 2026.

Which Node.js version should you run?

Production should only run Active or Maintenance LTS releases. The Node.js project publishes the schedule on GitHub and nodejs.org.

The schedule itself is changing. From Node.js 27 there is one major release a year: an alpha phase from October, a Current release in April, then promotion to LTS in October with 30 months of support. Every line becomes LTS, so odd and even numbers no longer matter. In practice, budget one runtime upgrade a year and you will never fall off support. One caveat: AWS Lambda’s Node.js 26 runtime is still in public preview, with general availability targeted for November 2026, so Lambda workloads should sit on nodejs24.x for now.

Moving off Node 20: an upgrade checklist

1. Find every place Node runs: servers, Docker base images, CI runners, serverless runtime settings and developer machines. The forgotten cron container is usually the one still on 18.
2. List native add-ons (image, crypto and database drivers) and confirm each has a build for the target version.
3. Read the breaking-change notes for every major you skip, not just the last one.
4. Run the test suite on both the old and new runtime in CI. If coverage is thin, write tests around the risky paths first.
5. Upgrade one low-risk service, watch error rates and memory for a week, then do the rest.
6. On Lambda, change the runtime identifier per function. The nodejs20.x runtime was deprecated on 30 April 2026 and function updates are blocked from 31 August 2027.
7. Pin the new version in .nvmrc, engines and the Dockerfile so it cannot drift back.

Express, Fastify, NestJS or Hono?

Our default for a new API is Fastify, NestJS for large multi-team back ends, and Express only when there is existing Express code worth keeping.

Node.js, Python or Go?

TypeScript is the baseline

TypeScript 7, released on 8 July 2026, is a native port of the compiler written in Go and type-checks large projects far faster than 6.x did. Separately, Node.js can now run .ts files directly: type stripping is on by default and marked stable in current releases. It removes types without checking them and rejects enums, namespaces with runtime code, parameter properties and decorators. So the rule does not change: type-check in CI, and validate input at runtime with Zod or JSON Schema, because types vanish once the code runs.

npm supply-chain security after the 2025 worms

On 8 September 2025 a phished maintainer account was used to publish malicious versions of chalk, debug and about 16 other popular packages, with code that tampered with crypto-wallet transactions in the browser. A week later the Shai-Hulud worm stole tokens and cloud keys from developer machines and CI, then used them to publish infected versions of more packages; CISA’s alert counted over 500. A second wave in November 2025 ran in preinstall scripts, before installation had even finished. GitHub responded by pushing trusted publishing from CI, which attaches provenance automatically for public packages, and by announcing shorter-lived tokens and the retirement of classic tokens. What we do on every project:

• Commit the lockfile and install with npm ci or a frozen pnpm install, never a floating npm install in CI.
• Block dependency install scripts unless a package is explicitly allowed. pnpm refuses unapproved build scripts by default and can hold back versions younger than a set age.
• Verify registry signatures and provenance with npm audit signatures.
• Keep long-lived publish tokens and broad cloud keys out of CI; use short-lived credentials instead.
• Review dependency updates like any other code change, and prefer fewer, well-maintained packages.

MERN, in one section

MERN (MongoDB, Express, React, Node.js) is still a quick way to build a prototype, or a product whose data really is documents: catalogues with varied attributes, content, event logs. For money, stock levels and data with many relationships, a relational database makes consistency far easier. Many teams who ask for MERN are better served by React through Next.js, a Node.js API and PostgreSQL, with MongoDB kept only for genuinely document-shaped parts.

Dedicated Node.js developers in India, or a project team?

Both models work. They differ in who manages the work and who carries delivery risk. With staff augmentation, engineers join your team, take tickets from your backlog and follow your reviews; you keep technical direction, so it suits companies with a strong tech lead. With a project team, we plan the milestones, manage the engineers and answer for delivery against a written scope, which suits companies without in-house engineering leadership. Our staff augmentation vs agency comparison goes deeper. In either model, the code should live in your repository from day one.

What drives the cost of a Node.js project

People researching the cost to hire Node.js developers usually compare hourly rates. The rate matters less than these factors, and the cheapest rate rarely produces the cheapest project once rework is counted. We do not publish prices; you get a written proposal after discovery.

• Integrations. Each payment, CRM, messaging or ERP connection adds design, error handling and testing, and some vendor sandboxes take weeks to obtain.
• Scale and real-time targets. Five hundred concurrent users and fifty thousand are different architectures.
• Data migration from an old system, especially when the data is messy.
• Compliance. Audit trails, data residency and access controls for HIPAA, GDPR or DPDP work.
• Testing expectations. A tested API costs more up front and much less in year two.
• Support after launch. Round-the-clock cover is available only under a managed-service SLA.

Common mistakes we fix

• An end-of-life Node.js inside a Docker base image nobody has rebuilt for a year.
• Synchronous file, crypto or image work inside a request handler, blocking the event loop for every user.
• Trusting TypeScript types at runtime instead of validating input.
• Sessions or rate-limit counters held in process memory, which break the day a second instance starts.
• No graceful shutdown, so every deploy drops in-flight requests.
• Microservices before there is a team to own each one.

How to choose a Node.js development partner

• Ask which LTS line they will start on, and who upgrades it and when.
• Ask to see a pipeline that runs tests, type checks and dependency audits on every pull request.
• Ask how they control install scripts and freshly published dependency versions.
• Confirm the repository, cloud accounts and domains are in your name from the start.
• Meet the engineers who will write the code before you sign.
• Check what handover includes: documentation, runbooks and architecture notes.
• Notice whether they ever tell you Node.js is the wrong choice.