Updatify / Node.js | Release notes

Notable Changes

• [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
• [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
• [09feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #65788
• [7efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542

Commits

• [d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #62251
• [1899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
• [ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491

Notable Changes

• [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [6274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542
• [53cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #65789
• [0529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
• [41c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
• [5197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416

Notable Changes

Out-of-band release to fix node --version which was reporting an alpha version.

Commits

• [ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #65568
• [0b0dd87fcc] - tools: fix tools/nix/list-requisites.sh (Antoine du Hamel) #65560

Notable Changes

• [74234ee30e] - (SEMVER-MINOR) benchmark: add –analyze mode to compare.js (James M Snell) #65416
• [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
• [3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
• [753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
• [3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
• [9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416

Notable Changes

• [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
• [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
• [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
• [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869

Notable Changes

• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146

Notable Changes

• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

Commits

• [248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [0a46d1ef66] - buffer: normalize lone “\r” in Blob native line endings (Daijiro Wachi) #64115

Notable Changes

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935

This is a security release.

Notable Changes

• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

• [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 6.28.0 (Node.js GitHub Bot)

Commits

• [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714

Notable Changes

New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes

• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

Commits

Notable Changes

• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

Notable Changes

• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183

This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0).

Commits

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
• (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

Commits

• [98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

• [9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

Commits

• [38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878

Notable Changes

Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in #63055.

Other notable changes

• [a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597

Notable Changes

• [b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
• [ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
• [9705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
• [40ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
• [d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
• [aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
• [6f37f7e240] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098

Notable Changes

• [189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562
• [f858c6140e] - (SEMVER-MINOR) fs: add Temporal.Instant support to Stats and BigIntStats (Livia Medeiros) #60789
• [0cbb3895df] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155

Commits

• [9a394bab84] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314
• [ad98b4620b] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
• [ba0736a847] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
• [5573a6a4a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255

Commits

• [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
• [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485
• [e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #62164
• [0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382
• [e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256
• [73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
• [ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730

Notable Changes

Experimental node:ffi module

Node.js now includes an experimental node:ffi module for loading dynamic libraries and calling native symbols from JavaScript.

The API is gated behind the --experimental-ffi flag and, when the Permission Model is enabled, requires --allow-ffi.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in #62072.

Other Notable Changes

• [34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
• [073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
• [98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713

We’re excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform.

As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the “Current” release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

Temporal API

The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy Date object.

Contributed by Richard Lau in #61806.

V8 14.6

The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134.

This version also includes:

• Upsert (https://github.com/tc39/proposal-upsert): [Weak]Map.prototype.getOrInsert(), [Weak]Map.prototype.getOrInsertComputed()
• Iterator sequencing (https://github.com/tc39/proposal-iterator-sequencing): Iterator.concat()

Contributed by Michaël Zasso in #61898.

Undici 8

Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js’s HTTP client implementation.

Deprecations and Removals

Notable Changes

• [3d87ecacbc] - (SEMVER-MINOR) cli: add –max-heap-size option (tannal) #58708
• [83c38672f7] - cli: add –require-module/–no-require-module (Joyee Cheung) #60959
• [54ef940e01] - (SEMVER-MINOR) crypto: add raw key formats support to the KeyObject APIs (Filip Skokan) #62240
• [f4a3edc47a] - (SEMVER-MINOR) fs: add throwIfNoEntry option for fs.stat and fs.promises.stat (Juan José) #61178
• [5cdcba17cc] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
• [8b6be3fe14] - module: mark require(esm) as stable (Joyee Cheung) #60959
• [68fbc0c6cc] - module: mark module compile cache as stable (Joyee Cheung) #60971

Notable Changes

Test runner module mocking improvements

MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single option MockModuleOptions.exports to align with user expectations and other test runners.

A default property on MockModuleOptions.exports represents the default export, and own enumerable properties are treated as named exports.

An automated migration is available to update user code: https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports

npx codemod @nodejs/mock-module-exports

Contributed by sangwook in #61727.

Other notable changes

• [312476cb84] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
• [62d2cd473b] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #58708
• [d0ebf0e44b] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183

This is a security release.

Notable Changes

• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
• (CVE-2026-21711) include permission check to pipe_wrap.cc (RafaelGSS) - Medium
• (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
• (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low

Commits

• [2086b7477b] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#834
• [0f9332a40a] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822

This is a security release.

Notable Changes

• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
• (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
• (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low

Commits

• [6fae244080] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#828
• [cc0910c62e] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822
• [80cb042cf3] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271

This is a security release.

Notable Changes

• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
• (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low

Commits

• [6f14ee5101] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#809
• [52a52ef619] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#822
• [30a3ab11e2] - (CVE-2026-21717) deps: V8: cherry-pick aac14dd95e5b (Joyee Cheung) nodejs-private/node-private#809

This is a security release.

Notable Changes

• (CVE-2026-21717) fix array index hash collision (Joyee Cheung)
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan)
• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina)
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS)pull/795>
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS)
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS)
• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina)

Commits

• [cfb51fa9ce] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#831
• [f333d0be5f] - deps: V8: override depot_tools version (Richard Lau) #62344
• [2acd5d1226] - deps: update undici to v6.24.1 (Matteo Collina) #62285

Notable Changes

• [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083

Commits

• [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033
• [b26d1c7fcb] - crypto: make –use-system-ca per-env rather than per-process (Aditi) #60678
• [e362635abf] - crypto: add missing AES dictionaries (Filip Skokan) #62099
• [6f975db8af] - crypto: fix importKey required argument count check (Filip Skokan) #62099
• [3beaf9c5fc] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
• [53afb0edd8] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150

Notable Changes

• [7b93a65f27] - build: test on Python 3.14 (Christian Clauss) #59983
• [6063d888fe] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
• [d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
• [4f42f8c428] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
• [b6ebf2cd53] - doc: add avivkeller to collaborators (Aviv Keller) #61115
• [35854f424d] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
• [5c6a076e5d] - meta: add Renegade334 to collaborators (Renegade334) #60714

Commits

Notable Changes

• [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
• [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
• [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741

Commits

• [6f580d5399] - assert: fix deepEqual always return true on URL (Xuguang Mei) #50853
• [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983
• [cc4f7af6f3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790
• [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419

Notable Changes

• [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343
• [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298
• [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #61869
• [9ddd1a9c27] - (SEMVER-MINOR) src,permission: add –permission-audit (RafaelGSS) #61869
• [0d97ec4044] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #61394

Commits

• [940b58c8c1] - buffer: optimize buffer.concat performance (Mert Can Altin) #61721
• [0589b0e5a1] - build: fix GN for new merve dep (Shelley Vohr) #61984

Notable Changes

• [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
• [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813
• [ee59127664] - sqlite: mark as release candidate (Matteo Collina) #61262
• [608736e19e] - (SEMVER-MINOR) stream: rename Duplex.toWeb() type option to readableType (René) #61632
• [a43375999f] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676

Commits

• [ab4375e141] - benchmark: add startup benchmark for ESM entrypoint (Joyee Cheung) #61769
• [8d83d8026b] - build: add temporal test on GHA windows (Chengzhong Wu) #61810

Notable Changes

• [8b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415
• [68da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456
• [f3a24c76e4] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167
• [1948861d23] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214
• [d6f7c8d06f] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433
• [cb54b3ca6e] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #60953
• [35b1759d06] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #60864

Notable Changes

• [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456

Commits

• [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456
• [a727054503] - deps: upgrade npm to 11.9.0 (npm team) #61685
• [c78c49ed6b] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
• [4790816d9b] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #61732
• [8c71740e8a] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #61683
• [e559ef6ab1] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605

Notable Changes

• [1f64d6841e] - build: add support for Python 3.14 (Christian Clauss) #59983
• [30e500fc09] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
• [bc0a55f086] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
• [8a67c00bf5] - doc: mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) #60954
• [3999c2a910] - meta: add avivkeller to collaborators (Aviv Keller) #61115
• [fa542fbae6] - meta: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
• [ff11eda2f2] - meta: add Renegade334 to collaborators (Renegade334) #60714

Notable Changes

• [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415
• [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503
• [dce657071e] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #61548
• [e62608bbcf] - src: improve TextEncoder encode performance with simdutf (Mert Can Altin) #61496
• [93938a4738] - (SEMVER-MINOR) stream: add bytes() method to node:stream/consumers (wantaek) #60426
• [5fe2582329] - (SEMVER-MINOR) test_runner: add env option to run function (Ethan Arrowood) #61367
• [a181d0c43d] - url: update Ada to v3.4.2 and support Unicode 17 (Yagiz Nizipli) #61593

Commits

Notable Changes

• [99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
• [fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167
• [0feab0f083] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #61167
• [e91b296001] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433
• [b351910af1] - (SEMVER-MINOR) sea: add --build-sea to generate SEA directly with Node.js binary (Joyee Cheung) #61167
• [957292e233] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167
• [f289817ff8] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #61266

Notable Changes

• [8f6fada8f1] - cli: add –require-module/–no-require-module (Joyee Cheung) #60959
• [bf8e738df4] - cli: mark –heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
• [7930d7a19b] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
• [44f61dfb92] - doc: add @avivkeller to collaborators (Aviv Keller) #61115
• [45903ee884] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
• [77faa14d99] - doc: mark –build-snapshot and –build-snapshot-config as stable (Joyee Cheung) #60954
• [aefbe4ba47] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750 permission:
• (CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748 src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790

Commits

• [a6a74b89a7] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
• [5100614e26] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748 lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760 src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

Commits

• [2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
• [3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler
• (CVE-2025-55132) disable futimes when permission model is enabled lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle tls:
• (CVE-2026-21637) route callback exceptions through error handlers

Commits

• [6badf4e6f4] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
• [37509c3ff0] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#791
• [eb8e41f8db] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• [ebbf942a83] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748

This is a security release.

Notable Changes

lib:

• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802
• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797 lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760 src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

Commits

• [8f9ba3f623] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
• [97fc9b0eb7] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#792

Notable Changes

• [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
• [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
• [8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
• [92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
• [b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
• [e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178
• [a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797

Notable Changes

• [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
• [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313

Commits

• [0f644df42e] - build: fix ‘implicit-function-declaration’ on OpenHarmony platform (hqzing) #59547
• [fba0025b9c] - build: use windows-2025 runner (Michaël Zasso) #59673
• [3456ec946d] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956
• [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571

This release reverts the spec-compliant behavior of sometimes throwing on localStorage access. We received feedback that this change on an experimental API was too breaking for a semver-minor release, so we decided to push it back for Node.js 26.0.0.

Commits

• [ff89b7b6c7] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
• [5316b580eb] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
• [ca878bc90e] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708
• [a4dee613fd] - Revert “lib: throw from localStorage getter on missing storage path” (Antoine du Hamel) #60750

Notable Changes

• [a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
• [4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351
• [727560a96d] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
• [506b79e888] - (SEMVER-MINOR) net: increase network family autoselection timeout to 500ms (Rod Vagg) #60334
• [166c72ec02] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
• [399b340022] - (SEMVER-MINOR) v8: adding total_allocated_bytes to HeapStatistics (Caio Lima) #60573

Commits

• [d5158a0a2d] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #60603

Notable Changes

The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers has now been addressed and now returns uninitialized memory as documented in the Buffer.allocUnsafe documentation.

Commits

• [0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162
• [a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #60205
• [99e2acf46b] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) #59396
• [c01c72b407] - benchmark: use non-deprecated WriteUtf8V2 method (Michaël Zasso) #60173
• [a42dbd138e] - build: ibmi follow aix visibility (SRAVANI GUNDEPALLI) #60360
• [5673a54a5d] - build: use call command when calling python configure (Jacob Nichols) #60098