Node.js 17

Node.js 17 was a short-lived, non-LTS line that moved the runtime to OpenSSL 3.0 and V8 9.5, and bundled npm 8. The OpenSSL change was the most operationally significant difference from the preceding line: applications, build tools, or dependencies that use older cryptographic algorithms or keys can fail with ERR_OSSL_EVP_UNSUPPORTED unless they are updated or, as a temporary workaround, run with the legacy OpenSSL provider enabled. Node.js 17 also changed dns.lookup() default result ordering to follow the operating system’s resolver order rather than preferring IPv4, which can expose IPv6 reachability or address-selection assumptions in applications and tests.

Node.js 17 has reached end of life, so it no longer receives security fixes, bug fixes, or compatibility maintenance from the Node.js project. Remaining on it leaves known and newly discovered runtime, npm, OpenSSL, and dependency-chain issues unpatched, and makes compliance exceptions harder to justify. Because it was not an LTS line, many libraries, native-module distributors, and deployment platforms concentrated validation and prebuilt-binary coverage on LTS releases instead. The OpenSSL 3 transition also creates a poor long-term position: relying on the legacy provider can keep obsolete cryptography working temporarily, but it does not remove the underlying compatibility or security concern. DNS behavior differences can cause environment-specific connection failures if IPv6 or resolver behavior was never tested deliberately.

Plan a move directly to a currently supported LTS Node.js line rather than treating Node.js 17 as an intermediate destination. Inventory production services, CI jobs, containers, serverless functions, developer toolchains, and embedded Node.js runtimes, then identify the actual Node.js versions they use. Run the application and its full test suite on the target LTS version, with dependency installation performed from the existing lockfile before updating dependencies selectively. Rebuild and test native addons, especially packages that depend on node-gyp or ship platform-specific binaries. Search for uses of legacy hashes, ciphers, keys, certificate settings, webpack or other build tooling, and any startup scripts that set --openssl-legacy-provider; upgrade the responsible dependency or configuration rather than carrying that flag forward. Test outbound and inbound network paths in IPv4- and IPv6-capable environments, and make DNS result ordering explicit where the application requires a particular preference. Update CI images, production base images, version constraints, and runtime monitoring together, then remove Node.js 17 from supported development and deployment paths after rollout validation.