64-bit
wixmachine scopenodejs.org · publisher-owned- File name
- node-v26.7.0-x64.msi
- SHA-256
- 28dd9d5e53f829a32310a4fed334000a1681a7534641c599d05617f893c06a2b
- Product code
- {7308A298-0F07-41A9-B373-72E1FAA64CBB}
by Node.js Foundation · MIT
Run JavaScript Everywhere
These URLs are the ones Node.js Foundation declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Node.js Foundation published. Delete it.
Windows · PowerShell
Get-FileHash "node-v26.7.0-x64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "node-v26.7.0-x64.msi"Expected output
28dd9d5e53f829a32310a4fed334000a1681a7534641c599d05617f893c06a2b
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "node-v26.7.0-x64.msi" /qn /norestartARM64 · machine scope · MSI convention
msiexec /i "node-v26.7.0-arm64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 64-bit
{7308A298-0F07-41A9-B373-72E1FAA64CBB}
Uninstall, with the usual prompts
msiexec /x {7308A298-0F07-41A9-B373-72E1FAA64CBB}Silent, for deployment
msiexec /x {7308A298-0F07-41A9-B373-72E1FAA64CBB} /qn /norestartProduct code · ARM64
{E5C3D325-1647-4F34-B1BA-44AB5ADF3C0E}
Uninstall, with the usual prompts
msiexec /x {E5C3D325-1647-4F34-B1BA-44AB5ADF3C0E}Silent, for deployment
msiexec /x {E5C3D325-1647-4F34-B1BA-44AB5ADF3C0E} /qn /norestartThe codes above belong to Node.js 26.7.0, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "Node.js*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 4 of 4 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 4 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 4 of 4 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MITA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Node.js registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from nodejs.org, which is a domain we have tied to Node.js Foundation.
Every one of the 4 installers on this page comes with the SHA-256 Node.js Foundation declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id OpenJS.NodeJS --exactUpgrade later
winget upgrade --id OpenJS.NodeJSWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Node.js, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
F260A2B468A72C7071EDD57DE032CC8C4097BB5BDBB1F1D76454CEC60C68CF5E
4EF6B8D0FEA7DAA7A5F2E0E5569354AB59A0B13DDB7C832BCE3A52F8ECC7473A
AA81C8552F251FF280134985CCDAF16D336E2961B1E2C3EEB7B7B2221509F723
0A738FFD9362003FC905F685B29BEC2ECA867D2F84F1BC37A70497423A0F7B1E
826A4551BB9D3C00C61C17A2521A1E901AC7304E3090A3C2D07C1E0FE2B4D60D
01875F52263953AD81972D304263F36A71E5E97873FA9FA60989E8973D18D00B
C432C996B95CBF7568F13A0FBB37526DE84A27E3A5C520C3BE15F05A9A168212
467F425228A2FDCC83A330F5F38B124B5B43B42F5033D7848B4E47C9BECC36F9
F18779F3317ADABFF835D294056EEFDBE6D0AE1C3CA38F8C909E7E7E1BD64B16
2D431D67BE866F7B0073467C0D48D002EF80EC9C38CE79C0928771CAA1E08898
D3B2277DBCCCFDF24EF6302928F64F484CFF1D77A6D3CAA3A28F4D20CE9158F6
C0CFA5877B6DE743301E622F5ABC4D26FB0FF8798ADFFC8FFFD2885F426008BA
C9DF873C4CF0463C63B79774D96B2E126CA6BA9D9F86529846864D41775101D6
76D6C1B2FEE84474374E445606B90CF6F1D8FFA22033F438C5008A21DD54FB35
5F87D038C6EC442AA46B9126F8CA170ACBD2F3B9B9152CA798CF54596A31E214
394CB72E664FAAA518CA1877BCC20BB03A3E2F51ED1F6CFCE53E1A306E8C97F6
C07B05C3B9E22E1A408E630285F15201B86EAA32F5D9CA8CF35132C9CAAC0CF0
BD0C50AFCC7140B64B12E24F73F0681D68F84205575893561E6344DC09B71FC7
45001B289EBFFE7B22260898F3750059183D8246042B88E8FFA4337E65E6763E
021EB7DE1D5257B24765F292DFCB469FF1528C29D88F48C875BEFB28114FB0FB
6281387DD8C022FD3191DE23904587815C3FAC3E6F91B7D36538D889C4C6F6A2
233FCB43BD419C8ECFFB8E862625705029A5F7F912C135F66BB7F1F8DB205C09
EC6D0F6B056C89498A9B26C4D5C77A31FD0B7FE45BA8A45FA87D26F66C3EBCE4
18C5014722E1DEBDB3E693501043A087485E6F1277B20C79C5EC86BCE6027EE0
51BE3A87789ECC7987C3D515EC805BF304955FE5F96167EF3001E5A428B3BF3E
922634A94FC0BEB8A3FEB448F55C600FB8EB6A0A598996A6536CB78E98CFC03C
371071A4F7E2C8A5DD280730049C685911FEECC59F50EBC488D675DC1087C69C
131EFA8BD858F8AD000A1A0436D8BB1320C638291C779A921FB20E5702A1CC0A
64A9313AE5334A3CE3E482B92D79AE4F9D62764C69D90849EC83C22854F7B0DA
1B16AC3CC9BA73EFDB65F1B2B39DDB746E55C3AFFC9684C1B6F10ECEFB25639C
089A02C4C687451C9F0B7F1BFD252DAE85A7BA27DF0295A14096BDCC956FDC92
0B913D67CCEF3E7E62EDCECD2DAF31DE5FD9551936501CCD3CD5C027ADA089EE
677460C6F7DF29A97986E73DAA931B4590A6FA841030F2C73F6B8186EE078868
F3A6DB3B60B4019A7EF67DB9885B2B06AA756953E15DB36602279C04CD10EA46
D0418640A36096E00BDDB57761AA0B1B98F91904EC4ED2B9DD75CBAD723BECD7
1931CEBF3CDA89DAB7CC5D4D0BF1923B8EFF8A4B054B6AAA8904BE0C14A070A4
E469104E5D0C99F9185FBF17179FBB1D732261E6E1F9D281B6B2308A0126FB6D
2E95E8CD93BD4CE3336DB9AFAD95D482BB2B29A74300F2A45223412508ECE63F
929552B8305EFFAC843BA7B4270C437AEFB702FC3FBD73FCD1BFFD35D4AC284E
6B499BCAF16C86FE1A98C8E2874FD1980B23B5C90EA412983DB4392D7E08C36B
176CC1D25EAACF1D8058BC319214CA156A4AD7B985D5AE0F239DBC26AA42FFD5
1D8E77A827BD19BAC021FCCD1F4B0E1F53EF2C4963C40AA2CFADFB8426486351
51815D5B0256B947D27D614DE04060FCFDBDB830D2C86E63E6F33DBF7964CCA7
A08E817D3CA86E065898C7D926F9C0C9A6D812AC9888F7F7CFD8C147EE8CBB29
7D9968ABA0B0A9C4410A4E8CEF882E96DCA620C7E184BD3924902783D0F1432C
3A43F14BB621B7702D7B69B08E771F521CCC50C30E6205C295FB028012BE1798
09A5A0DBB2F4CEFA800880012810E2DFAAC0016A62E75F064C4AB7F3606B2D78
0C5BE793A169DB0812F8549B367FC1591BD3E4C401A5C700DD8B8B2CC2E74C5E
D60366F4A727D09281D1EC1F9C6BFF491197796497E0A8F183390B55F18429ED
9761B59BCF92EBD572B1023D550D5D6C848ADC3CAC51FF523E55ADEE6E65E664
5744746371A417179A701044739B5FA2B3164E943AA57F86059FB312F8032E86
EFDADD968946F58BE79BCDA43CF2704B5BFAEC5DB48C8C502583B20F795AF298
5CB49889FD408AB9FE19471B0AB52BADAF5724E47A6F824B0E11CAFD09576838
39D400DB485FDB261981849A15C52C1F051FF8356C0F75C02BB09151498C290D
4A66EAC416C30474FE9C3F0EF7D4FFC85A8797CBC35F6B8566DFBCE02789A9C4
8B824EB15AE95D24BD082CEE9637F74D5850BA5C8649BD65C5F108E360835F1E
8906E19AE88FDFA2DAB2E140667DFA05A70B746BD0CA4D1B849AA5C7CBB71DC9
4B1D58E83A854481E87E21CE636ADA04364C8B952095E545CBF91435911027A5
0AE2300CDF44C399B5B351EDBEFB3534D1342A6FABD64302CA8C8E2FB86B0445
E11F610F584261617259ABA8CBB8D2AF6D1EB726CC0A433197572E5882D0BF77
9A60C1001DC34D108F9E031D8FAD2125D407C9A7EFDB865E3E00B7C3A34A32D3
8D21C43D734400B1D63B1A48A0E08545E6920E6D810166CCC0887426448E4DB0
133686ADE5CD1E1686AFCF2D688530FC35AFEF649DDF6A491E4705610727BD23
0124A8041CDDE07C068C08FDCF4CDC59F83BDE8D4B78DC9ECA3B5D80672B9E40
AF80A24744FF17C98818699DA9680F805BB332708FF535967E39940B4BF1195D
864C58B9A092A35653A5E5F4D5961A54C1428E9DC9D4B7AC826CA229BBC6996A
4D2773E98D3F35D172478D5101DE1F571D851053D2ED67BBE39A5BDEAE87D804
7CA3D9BB4BF745E4BCD7B6AE6840C37FBD12DA909EE5DF6B932AF42CDD997A19
54E212E905BE2D71145AB986834EC53116303A8A8B6F1162084983B8BD8B46FD
D89169C597BB7F13A5295AD05C3B640B0068C9D0493E39D33DF022DE0CAF6BA1
5A5FCD17BC7567645C85B016CD428E4CD9E54796994651BE3F3709768714E002
AB747B4D8579AA95EF7148A883FEA5A5577DFBCC1BFBC4F62BB4257C26B27ACC
3F8C82F6D7EDC2B00A1C9852E3BDD16FEB6DBF8990279DA9650A2FCA9EBFDD65
6F6D3BBC3EDF9F52E168FCACB065BDB6AB8A496B9A6E75EE11637FC3A79CB873
3C138BA2CD835B1AF70AE2813422F544B2E786BDFF8C0885FFB89FB7D407148E
EF217B4313CC6E9BD34A599E4D90F2E40A7CA5C30AE5A3098B32054B1C0D1727
4E16E4F3E761BC1242AB4F4F191B3F570CB498E31F3D6F14E01CAF0DB2573C22
7A6A25009F42CD183E66EDE7C287F8EBE5BBF6019AE4DC2433F22DCB3B37AA70
F97BA75EAD7720652F3925D9CF8661E083A28C6B98EA77ACC83903D77A9DD688
E2A3EDA9FABF97929274CC9CBBF4F374743765630CBB1691A22D01040B0CF23A
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Node.js version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Node.js Foundation and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Node.js — just other entries, each with its own official URL and published hash.