Updatify / Node.js | Release notes

Notable Changes

• [4395fe14b9] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
• [2e55c6ad04] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
• [f437204491] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178

Commits

• [bb27766bd5] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162
• [e600711c20] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #60205
• [1bbcdf9039] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) #59396
• [22fa6bd28b] - build: ibmi follow aix visibility (SRAVANI GUNDEPALLI) #60360

Commits

• [af33e8e668] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #59872
• [6764ce8756] - benchmark: update count to n in permission startup (Bruno Rodrigues) #59872
• [4e8d99f0dc] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59872
• [af0a8ba7f8] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #59708
• [78efd1be4a] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59708
• [df72dc96e9] - console,util: improve array inspection performance (Ruben Bridgewater) #60037
• [ef67d09f50] - http: improve writeEarlyHints by avoiding for-of loop (Haram Jeong) #59958

Notable Changes

This release marks the transition of Node.js 24.x into Long Term Support (LTS) with the codename ‘Krypton’. It will continue to receive updates through to the end of April 2028.

Other than updating metadata, such as the process.release object, to reflect that the release is LTS, no further changes from Node.js 24.10.0 are included.

Known issue

An issue has been identified in the Node.js 24.x line with Buffer.allocUnsafe unintentionally returning zero-filled buffers. This API is documented to return uninitialized memory. The documented behavior will be restored in the next Node.js 24.x LTS release to bring it back in line with previous releases. For more information, see #60423.

Notable Changes

• [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #59151
• [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165
• [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
• [42102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
• [686ac49b82] - (SEMVER-MINOR) src: add percentage support to --max-old-space-size (Asaf Federman) #59082

Commits

• [a71dd592e3] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #59696

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements, built-in Uint8Array base64/hex conversion, and ongoing WebAssembly and JIT pipeline optimizations.

This release doubles down on secure-by-default apps and web-standard APIs: the permission model gains --allow-net, Web Storage is enabled by default, and ErrorEvent is now a global.

We’ve also removed or finalized long-deprecated APIs such as SlowBuffer, and added quality-of-life improvements like a portable compile cache and JSPI for WebAssembly.

Notable Changes

• [8bc7dfd16f] - build: test on Python 3.14 release candidate 3 (Christian Clauss) #59983
• [663554abdf] - (SEMVER-MAJOR) lib: expose global ErrorEvent (Richie Bendall) #58920
• [3312e4e946] - (SEMVER-MAJOR) src: unflag –experimental-webstorage by default (Daniel M Brasil) #57666
• [462c74181d] - (SEMVER-MAJOR) src,permission: add –allow-net permission (Rafael Gonzaga) #58517

Deprecations and Removals

Notable Changes

• [31bb476895] - (SEMVER-MINOR) console: allow per-stream inspectOptions option (Anna Henningsen) #60082
• [3b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #59980
• [18c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #59928

Commits

• [e8cff3d51e] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #59872
• [03294252ab] - benchmark: update count to n in permission startup (Bruno Rodrigues) #59872
• [3c8a609d9b] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59872
• [7b2032b13e] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #59708

Notable Changes

• [9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
• [a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #58378
• [5563361d22] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #58748
• [04013ee933] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846

Commits

• [cbec4fd6de] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #59696
• [9a4bbdc3c5] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #59836
• [0b284d86e8] - build: add the missing macro definitions for OpenHarmony (hqzing) #59804

Notable Changes

OpenSSL updated to 3.5.2

For official Node.js builds, or builds using the default build configuration, Node.js now bundles OpenSSL 3.5.2. This update allows Node.js 22.x to be supported through to the planned End-of-Life date of 2027-04-30 as the previously bundled OpenSSL 3.0.x goes out of support in September 2026.

This change does not affect third-party builds of Node.js that link to an external OpenSSL (or OpenSSL-compatible) library.

Other notable changes

• [5b83e1e0a2] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
• [34b25fd97b] - doc: stabilize –disable-sigusr1 (Rafael Gonzaga) #59707
• [bf41218ed9] - doc: mark path.matchesGlob as stable (Aviv Keller) #59572
• [1dbad2058f] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315

Notable Changes

HTTP/2 Network Inspection Support in Node.js

Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.

Usage

Write a test.js script that makes HTTP/2 requests.

const http2 = require('node:http2');

const client = http2.connect('https://nghttp2.org');

const req = client.request([
  ':path', '/',
  ':method', 'GET',
]);

Run it with these options:

node --inspect-wait --experimental-network-inspection test.js

Open about:inspect on Google Chrome and click on Open dedicated DevTools for Node. The Network tab will let you track your HTTP/2 calls.

Contributed by Darshan Sen in #59611.

Other Notable Changes

• [7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #59570
• [4b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #59570
• [3e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #59647

Notable Changes

• [f5b293ad48] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [4e6ae787c6] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [d06db658fc] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [3c6206cac9] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241

Commits

• [ea20403467] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
• [c647aa4b30] - build: fix pointer compression builds (Joyee Cheung) #58171
• [d2c5e609ae] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867

Notable Changes

• [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
• [cda1dab6e2] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
• [1f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
• [bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [fa9a9e9c69] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
• [390a9dc20b] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243

Notable Changes

Post-Quantum Cryptography in node:crypto

OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by allowing use of NIST’s post-quantum cryptography standards for future-proofing applications against quantum computing threats. The following post-quantum algorithms are now available in node:crypto:

• ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new crypto.encapsulate() and crypto.decapsulate() methods.
• ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing crypto.sign() and crypto.verify() methods.

Contributed by Filip Skokan in #59259 and #59491.

Modern Algorithms in Web Cryptography API

The second substantial extension to the Web Cryptography API (globalThis.crypto.subtle) was recently accepted for incubation by WICG. The following algorithms and methods from this extension are now available in the Node.js Web Cryptography API implementation:

• AES-OCB
• ChaCha20-Poly1305
• ML-DSA
• ML-KEM
• SHA-3
• SHAKE
• subtle.getPublicKey()
• SubtleCrypto.supports()
• … with more coming in future releases.

Notable Changes

• [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259
• [201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240
• [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
• [c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
• [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897

Commits

• [f7484575ff] - assert: change utils to use index instead of for…of (방진혁) #59278

Notable Changes

Upgrade to OpenSSL 3.5

This release is distributed with OpenSSL 3.5.1, following the announcement that OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be supported until April 2028. Read more about OpenSSL support in their blog post: https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.

Contributed by Richard Lau in #58100.

Unflag --experimental-wasm-modules

Node.js supports both source phase imports and instance phase imports to WebAssembly modules and for WASM imports to JavaScript, in line with the current Phase 3 WebAssembly ESM Integration proposal. The implementation and the specification are still subject to change.

Contributed by Guy Bedford in #57038.

Built-in proxy support in request() and Agent

node:http and node:https now support proxies. When NODE_USE_ENV_PROXY is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY, https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the environment variables, and proxy the requests sent through the built-in http/https client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

Notable Changes

Type stripping is enabled by default

Node.js will be able to execute TypeScript files without additional configuration:

$ echo 'const foo: string = 'World'; console.log(`Hello ${foo}!`);' > file.ts
$ node file.ts
Hello World!

There are some limitations in the supported syntax documented at https://nodejs.org/api/typescript.html#type-stripping.

This feature is experimental and is subject to change. Disable it by passing --no-experimental-strip-types CLI flag.

Contributed by Marco Ippolito in #56350.

Other notable changes

• [26f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #56350
• [d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
• [8ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [430e66b9b8] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #57804

This is a security release.

Notable Changes

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [db7b93fcef] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

This is a security release.

Notable Changes

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [8cf5d66ab7] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721
• [9c0cb487ec] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902

This is a security release.

Notable Changes

• (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

• [c33223f1a5] - (CVE-2025-27209) deps: V8: revert rapidhash commits (Michaël Zasso) nodejs-private/node-private#713
• [56f9db2aaa] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

Notable Changes

• [22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi) #58121
• [80dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
• [87f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons) #58516
• [9623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853
• [797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697
• [ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951

Notable Changes

⚠️ Deprecations

Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new keyword is now discouraged. This clarifies API expectations and aligns with standard JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change encourages explicit choices (e.g., shell: true or a shell path) and avoids relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #58313.

✅ Features graduated to stable

assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons, useful for flexible test assertions. Its stabilization means it’s now safe for general use and won’t change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #57370.

Miscellaneous

Notable Changes

• [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
• [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
• [7cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282
• [dce1995c55] - Revert “test_runner: remove promises returned by t.test()” (Romain Menke) #58282
• [8b0c5edbb6] - Revert “test_runner: remove promises returned by test()” (Romain Menke) #58282
• [713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #58438

Notable Changes

• [c535a3c483] - crypto: graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142
• [af1dc63815] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [01d63a4ddf] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [b6daa344eb] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102

Commits

• [fc1fa7a357] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [79e0812181] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
• [f56e62851a] - crypto: allow length=0 for HKDF and PBKDF2 in SubtleCrypto.deriveBits (Filip Skokan) #55866

Notable Changes

Remove support for HTTP/2 priority signaling

The support for priority signaling has been removed in nghttp2, following its deprecation in the RFC 9113. As a consequence of this, priority signaling is deprecated on all release lines of Node.js, and removed from Node.js 24 so we can include latest updates from nghttp2.

Contributed by Matteo Collina and Antoine du Hamel in #58293.

import.meta.main is now available

Boolean value available in ECMAScript modules, which can be used to detect whether the current module was the entry point of the current process.

export function foo() {
  return 'Hello, world';
}

function main() {
  const message = foo();
  console.log(message);
}

if (import.meta.main) main();
// `foo` can be imported from another module without possible side-effects from `main`

Contributed by Joe and Antoine du Hamel in #57804.

Other Notable Changes

• [e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [984894b38c] - doc: deprecate util.isNativeError in favor of Error.isError (Miguel Marcondes Filho) #58262

Notable Changes

• [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
• [f7041b9369] - Revert “test_runner: change ts default glob” (Théo LUDWIG) #58202

Commits

• [b33e8d2a71] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149
• [a1b078b18c] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #58258
• [4c967b73c3] - buffer: use constexpr where possible (Yagiz Nizipli) #58141

Notable Changes

• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #57765
• [e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #58011
• [832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #57610
• [c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #57490
• [5d1230bec0] - (SEMVER-MINOR) src: set default config as node.config.json (Marco Ippolito) #57171

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [7d0c17b2ad] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

This is a security release.

Notable Changes

src:

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [a271810ce2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792
• [a12107f0dd] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [eb25047b1b] - deps: update llhttp to 9.2.0 (Node.js GitHub Bot) #51719
• [12dcd8db08] - deps: update llhttp to 9.1.3 (Node.js GitHub Bot) #50080
• [190e45a291] - (SEMVER-MAJOR) (CVE-2025-23167) deps: update llhttp to 9.1.2 (Paolo Insogna) #48981
• [fc68c44e6a] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9e13bf0a81] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [bd0aa5d44c] - (CVE-2024-27982) http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#556

Notable Changes

• [2e1d9581e0] - Revert “buffer: move SlowBuffer to EOL” (Filip Skokan) #58211

Commits

• [d38e811c5b] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #58128
• [2e1d9581e0] - Revert “buffer: move SlowBuffer to EOL” (Filip Skokan) #58211
• [a883b0c979] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #58115
• [3d84b5c7a4] - doc: add HBSPS as triager (Wiyeong Seo) #57980
• [1e57cb686e] - doc: add history entries to --input-type section (Antoine du Hamel) #58175
• [0b54f06b6f] - doc: add ambassaor message (Brian Muenzenmeyer) #57600

We’re excited to announce the release of Node.js 24! This release brings several significant updates, including the upgrade of the V8 JavaScript engine to version 13.6 and npm to version 11. Starting with Node.js 24, support for MSVC has been removed, and ClangCL is now required to compile Node.js on Windows. The AsyncLocalStorage API now uses AsyncContextFrame by default, and URLPattern is available globally. These changes, along with many other improvements, continue to push the platform forward.

As a reminder, Node.js 24 will enter long-term support (LTS) in October, but until then, it will be the “Current” release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

V8 13.6

The V8 engine is updated to version 13.6, which includes several new JavaScript features:

• Float16Array
• Explicit resource management
• RegExp.escape
• WebAssembly Memory64
• Error.isError

The V8 update was a contribution by Michaël Zasso in #58070.

npm 11

Notable Changes

• [3c88f3938b] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [db19a3f9fc] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #57370
• [1ee5f840b4] - (SEMVER-MINOR) cli: allow –cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
• [872ee0f2ac] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [03a0f3a56b] - (SEMVER-MINOR) crypto: support –use-system-ca on Windows (Joyee Cheung) #56833
• [94647bbdb2] - (SEMVER-MINOR) crypto: added support for reading certificates from macOS system store (Tim Jacomb) #56599
• [8f7b86a6e7] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876

Notable Changes

• [d5e73ce0f8] - deps: update undici to 6.21.2 (Matteo Collina) #57442
• [e4a6323ab2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792

### Commits

• [d5e73ce0f8] - deps: update undici to 6.21.2 (Matteo Collina) #57442
• [e4a6323ab2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792
• [b2b9eb36af] - dns: restore dns query cache ttl (Ethan Arrowood) #57640
• [07a99a5c0b] - doc: correct status of require(esm) warning in v20 changelog (Joyee Cheung) #57529
• [d45517ccbf] - meta: bump Mozilla-Actions/sccache-action from 0.0.8 to 0.0.9 (dependabot[bot]) #57720

Notable Changes

• [64b086740a] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [053cef70e0] - (SEMVER-MINOR) crypto: add optional callback to crypto.diffieHellman (Filip Skokan) #57274
• [f8aff90235] - (SEMVER-MINOR) process: add execve (Paolo Insogna) #56496
• [4b04c92d7d] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #57490
• [1b8d1d3a3a] - (SEMVER-MINOR) util: expose diff function used by the assertion errors (Giovanni Bucci) #57462

Commits

• [7b72396c8b] - assert: improve partialDeepStrictEqual performance (Ruben Bridgewater) #57509
• [64b086740a] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370

Notable Changes

This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.

Commits

• [f737a79073] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #51501
• [fce923ba69] - build: update gcovr to 7.2 and codecov config (Benjamin E. Coe) #54019
• [8b7ffd807c] - build: fix compatibility with V8’s depot_tools (Richard Lau) #57330
• [ee9a343413] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [738bf8aea4] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681
• [69d661d591] - deps: update undici to v5.29.0 (Matteo Collina) #57557
• [59fcf43b0e] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265

Notable Changes

Introducing --experimental-config-file

With the introduction of test runner, SEA, and other feature that require a lot of flags, a JSON config flag would improve by a lot the developer experience and increase adoption.

You can have a node.config.json containing:

{
  "$schema": "https://nodejs.org/dist/v23.10.0/docs/node-config-schema.json",
  "nodeOptions": {
    "test-coverage-lines": 80,
    "test-coverage-branches": 60
  }
}

You can run your tests without passing the flags defined in the config file.

node --experimental-default-config-file --test --experimental-test-coverage

or

node --experimental-config-file=node.config.json --test --experimental-test-coverage

Node.js will not sanitize or perform validation on the user-provided configuration, so only ever use trusted configuration files.

Contributed by Marco Ippolito in #57016 and #57171.

Other Notable Changes

• [323e3ac93c] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [6fd2ec6816] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241

Notable Changes

require(esm) is now enabled by default

Support for loading native ES modules using require() had been available on v20.x under the command line flag –experimental-require-module, and available by default on v22.x and v23.x. In this release, it is now no longer behind a flag on v20.x.

This feature has been tested on v23.x and v22.x, and we are looking for user feedback from v20.x to make more final tweaks before fully stabilizing it. It now no longer emits a warning unless --trace-require-module is explicitly used. If there happens to be any regressions caused by this feature, users can report it to the Node.js issue tracker. Meanwhile this feature can also be disabled using --no-experimental-require-module as a workaround.

With this feature enabled, Node.js will no longer throw ERR_REQUIRE_ESM if require() is used to load a ES module. It can, however, throw ERR_REQUIRE_ASYNC_MODULE if the ES module being loaded or its dependencies contain top-level await. When the ES module is loaded successfully by require(), the returned object will either be a ES module namespace object similar to what’s returned by import(), or what gets exported as "module.exports" in the ES module.

Notable Changes

• [927d985aa0] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #52983
• [0236fbf75a] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #56467

Commits

• [f4a82fddb1] - benchmark: add a warmup on bench-openSync (Elves Vieira) #57051
• [b384baa073] - build: print ‘Formatting Markdown…’ for long task markdown formatting (1ilsang) #57108
• [fec2d50308] - build: add skip_apidoc_files and include QUIC (RafaelGSS) #56941
• [5af35d1850] - build: fix GN build failure (Cheng) #57013
• [35f89aa66f] - build: fix GN build of uv (Cheng) #56955

Notable Changes

• [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566

Commits

• [bb2977ca6c] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
• [92896945b8] - build: support python 3.13 (Chengzhong Wu) #53190
• [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
• [d03a23577d] - deps: V8: cherry-pick 26fd1dfa9cd6 (Shu-yu Guo) #55873
• [53bb21b093] - deps: V8: backport ae5a4db8ad86 (Shu-yu Guo) #55873
• [5eb6dfe284] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #55980

Notable Changes

Support for using system CA certificates store on macOS and Windows

This version adds the --use-system-ca command-line flag, which instructs Node.js to use the trusted CA certificates present in the system store along with the --use-bundled-ca, --use-openssl-ca options.

This option is available on macOS and Windows for now.

Contributed by Tim Jacomb in #56599 and Joyee Cheung in #56833.

Introduction of the URL Pattern API

An implementation of the URL Pattern API is now available.

The URLPattern constructor is exported from the node:url module and will be available as a global in Node.js 24.

Contributed by Yagiz Nizipli and Daniel Lemire in #56452.

Support for the zstd compression algorithm

Node.js now includes support for the Zstandard (zstd) compression algorithm. Various APIs have been added to the node:zlib module for both compression and decompression of zstd streams.

Contributed by Jan Krems in #52100.

Node.js thread names

Threads created by the Node.js process are now named to improve the debugging experience. Worker threads will use the name option that can be passed to the Worker constructor.

Notable Changes

• [82a9000e9e] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
• [b7fe54fc88] - (SEMVER-MINOR) fs: allow exclude option in globs to accept glob patterns (Daeyeon Jeong) #56489
• [3ac92ef607] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #56359
• [1614e8e7bc] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #56610
• [6d6cffa9cc] - (SEMVER-MINOR) module: add findPackageJSON util (Jacob Smith) #55412
• [d35333ae18] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #56400
• [07ff3ddcb5] - (SEMVER-MINOR) sqlite: support TypedArray and DataView in StatementSync (Alex Yang) #56385

Notable Changes

• [030f155986] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #55333
• [b9b006331f] - doc: add LJHarb to collaborators (Jordan Harband) #56132
• [39b89e90b4] - doc: enforce strict policy to semver-major releases (Rafael Gonzaga) #55732
• [247fa1959f] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681
• [adfc2f993a] - tools: fix root certificate updater (Richard Lau) #55681
• [29862ae105] - doc: add jazelly to collaborators (Jason Zhang) #55531

Commits

• [b4f5da18a5] - benchmark: add test-reporters (Aviv Keller) #55757

Notable Changes

• [36dd9ecc41] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
• [9414d3cbf1] - (SEMVER-MINOR) fs: allow exclude option in globs to accept glob patterns (Daeyeon Jeong) #56489
• [9c5c3b3115] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #56610
• [1e201fd5fd] - (SEMVER-MINOR) sqlite: support TypedArray and DataView in StatementSync (Alex Yang) #56385
• [48c813fb67] - (SEMVER-MINOR) src: add –disable-sigusr1 to prevent signal i/o thread (Rafael Gonzaga) #56441
• [cf16123785] - (SEMVER-MINOR) src,worker: add isInternalWorker (Carlos Espa) #56469
• [13bdd9c961] - (SEMVER-MINOR) test_runner: add TestContext.prototype.waitFor() (Colin Ihrig) #56595

This is a security release.

Notable Changes

• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [c03ad5ed63] - build: use rclone instead of aws CLI (Michaël Zasso) #55617
• [8232463294] - build, tools: drop leading / from r2dir (Richard Lau) #53951
• [b26bcd3394] - build, tools: copy release assets to staging R2 bucket once built (flakey5) #51394
• [56df127b7b] - build,tools: simplify upload of shasum signatures (Michaël Zasso) #53892
• [a63e9372ed] - (CVE-2025-22150) deps: update undici to v5.28.5 (Matteo Collina) nodejs-private/node-private#657

This is a security release.

Notable Changes

• CVE-2025-23083 - throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [df8b9f2c3e] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#663
• [42d5821873] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
• [8187a4b9bb] - src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS)
• [389f239a28] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#652

This is a security release.

Notable Changes

• CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [520da342e0] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#662
• [99f217369f] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
• [984f735e35] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
• [2446870618] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#651

This is a security release.

Notable Changes

• CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [f2ad4d3af8] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#654
• [0afc6f9600] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (RafaelGSS) nodejs-private/node-private#555
• [3c7686163e] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
• [51938f023a] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#629

Notable Changes

Stabilize Permission Model

Upgrades the Permission Model status from Active Development to Stable.

Contributed by Rafael Gonzaga #56201

Graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable

Following the merge of Curve25519 into the Web Cryptography API Editor’s Draft the Ed25519 and X25519 algorithm identifiers are now stable and will no longer emit an ExperimentalWarning upon use.

Contributed by (Filip Skokan) #56142

Other Notable Changes

• [05d6227a88] - (SEMVER-MINOR) assert: add partialDeepStrictEqual (Giovanni Bucci) #54630
• [a933103499] - (SEMVER-MINOR) cli: implement –trace-env and –trace-env-[js|native]-stack (Joyee Cheung) #55604
• [ba9d5397de] - (SEMVER-MINOR) dgram: support blocklist in udp (theanarkh) #56087
• [f6d0c01303] - doc: stabilize util.styleText (Rafael Gonzaga) #56265

Notable Changes

Unflagging –experimental-strip-types

This release enables the flag --experimental-strip-types by default. Node.js will be able to execute TypeScript files without additional configuration:

node file.ts

There are some limitations in the supported syntax documented at https://nodejs.org/api/typescript.html#type-stripping This feature is experimental and is subject to change.

Contributed by Marco Ippolito in #56350

Other Notable Changes

• [c1023284c3] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #56359
• [8dc39e5e2e] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #56400
• [8b20cc212b] - (SEMVER-MINOR) worker: add eval ts input (Marco Ippolito) #56394

Commits

• [7b4d288116] - assert: make partialDeepStrictEqual throw when comparing [0] with [-0] (Giovanni) #56237

Notable Changes

WebCryptoAPI Ed25519 and X25519 algorithms are now stable

Following the merge of Curve25519 into the Web Cryptography API Editor’s Draft the Ed25519 and X25519 algorithm identifiers are now stable and will no longer emit an ExperimentalWarning upon use.

Contributed by Filip Skokan in #56142.

On-thread hooks are back

This release introduces module.registerHooks() for registering module loader customization hooks that are run for all modules loaded by require(), import and functions returned by createRequire() in the same thread, which makes them easier for CJS monkey-patchers to migrate to.

import assert from 'node:assert';
import { registerHooks, createRequire } from 'node:module';
import { writeFileSync } from 'node:fs';

writeFileSync('./bar.js', 'export const id = 123;', 'utf8');

registerHooks({
  resolve(specifier, context, nextResolve) {
    const replaced = specifier.replace('foo', 'bar');
    return nextResolve(replaced, context);
  },
  load(url, context, nextLoad) {
    const result = nextLoad(url, context);
    return {
      ...result,
      source: result.source.toString().replace('123', '456'),
    };
  },
});

// Checks that it works with require.
const require = createRequire(import.meta.url);
const required = require('./foo.js');  // Redirected by resolve hook to bar.js