News - Node.js

Node.js 24.22.0 (LTS)

Richard Lau — Wed, 14 Oct 2026 15:26:48 GMT

Node.js 24.22.0 (LTS)

Richard Lau

2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95

Notable Changes

[ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
[d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[acc1578179] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
[a7f8de6362] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[60c3eb61bd] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[6b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[75456a3512] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[72d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[41161dda87] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
[adbc757d70] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
[241339f072] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[63b0974d9e] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[a3bbb5a26f] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899

Commits

[e6832b2cb1] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449
[a079177d9f] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #65922
[10b1a0f70f] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587
[e0c7ba8ad5] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594
[21fed10bb0] - benchmark: add crypto class benchmarks (Filip Skokan) #65518
[fa912242b7] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905
[a6bd0c1413] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023
[94e12139ee] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744
[7a2f322943] - build: fix quiet default for make builds (Shelley Vohr) #65826
[c280d650b0] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797
[4b23a4472c] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237
[676e15c003] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464
[f784058482] - build: remove obsolete configure flags (Chengzhong Wu) #65456
[f63f37d243] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
[da46ac075d] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
[249e9a16dd] - build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #66082
[146f00f64b] - child_process: clear timeout timer on spawn-time error too (kishore280) #65506
[13987f4418] - crypto: remove redundent std::move call (Antoine du Hamel) #66111
[ef957ac85f] - crypto: skip private RSA parameters in key details (Filip Skokan) #66108
[8feccc5e22] - crypto: use provider EC group names (Filip Skokan) #66108
[764e0d1120] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108
[50ffed1979] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #66108
[56c16b2fd6] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108
[a4effe6809] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966
[ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[8e631aa48f] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759
[5c51129e16] - crypto: optimize private EC JWK import (Filip Skokan) #65908
[c2ec40c2d7] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172
[e198aa0f79] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108
[253784f0e9] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892
[80a6ad509b] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908
[5b592b772c] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908
[ee956ae3bf] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908
[684008be58] - crypto: read EC curve metadata directly (Filip Skokan) #65908
[f4665f1c41] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704
[624abbecd7] - crypto: use primordials in HKDF info validation (Filip Skokan) #65704
[e4d916f175] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073
[db8a9162a8] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649
[022ac83504] - crypto: cache valid ECDH key pairs (Filip Skokan) #65615
[c61953ebcc] - crypto: add strict mode to --force-fips (Filip Skokan) #65645
[db6ea132a5] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645
[c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[2b62aafd20] - crypto: validate JWK usages before key_ops (Filip Skokan) #65550
[ec7819db69] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550
[a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
[5a46a9acbb] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222
[191ebfb26c] - crypto: fix public PKCS8 export error (한국) #65609
[b6d7ed372b] - crypto: fix private SPKI export error (Filip Skokan) #65550
[79509c25a4] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450
[9adc87bc16] - crypto: harden X509Certificate state (Filip Skokan) #65518
[c63aa331b4] - crypto: optimize key slot caching (Filip Skokan) #65518
[87daea43a7] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457
[98ca5e9358] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112
[0c090a28cd] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503
[a13cc3f723] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #65503
[b8db0045ef] - deps: V8: cherry-pick ea9c016f26ad (Gundepalli Sravani) #66570
[ba09b53487] - deps: V8: backport c3553509f460 (Jakob Linke) #66089
[9ce8ef405b] - deps: V8: backport 8901c793e439 (Toon Verwaest) #66089
[fb0d0ca289] - deps: V8: backport 0b94a9fd23ba (Ruan Gustavo) #65753
[2faca508c0] - deps: update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) #66009
[4396c9bffe] - deps: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) #65833
[8a5b12570c] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #65834
[c47feb09e8] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #65835
[9f0d905286] - deps: upgrade npm to 11.19.1 (npm team) #65573
[373cd332d8] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654
[aeed6132a7] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655
[2583571342] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494
[d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[0a4a8d602a] - doc: fix duplicate 'the' typo in node_platform.cc (Muhammad Al-Muzahid) #66058
[b6538138ef] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #65869
[d319fa7de4] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #66038
[67cb305b59] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #65877
[160d44e025] - doc: clarify QUIC async write backpressure (John Finnerty) #65947
[ffd47a7ee5] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #66004
[2e1772a8ab] - doc: fill in missing zstd docs (James M Snell) #65867
[9f88c6f8dc] - doc: add inoway46 as triager (Yuya Inoue) #65565
[c2620d01f3] - doc: document windowsHide for child_process.fork (Christopher Buss) #65887
[6076111e1a] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #65868
[7bf048a336] - doc: add DOMException section to errors API reference (Avocado) #65206
[414b6bfa62] - doc: expand revert commit collaborator instructions (Mike McCready) #65848
[c8ac91692c] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #65691
[cc47cc0983] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436
[8b79a71e78] - doc: fix default limit of maxHeadersCount (Aryn H) #65472
[56b1252a54] - doc: fix return types for sync methods (Chiang Fong Lee) #58575
[da0d32a333] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #64993
[f8ab3619b6] - doc: document close() error when in a sqlite callback (Trivikram Kamat) #65090
[131f1db302] - doc: clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743
[7755e98183] - doc: update changelog-maker instructions for releasing (Juan José) #65707
[f982a53433] - doc: add stability status to crypto.setEngine (Antoine du Hamel) #65746
[17be003f7c] - doc: remove outdated TLS authorized warning (Tim Perry) #65597
[424002232d] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523
[dddb9b57a5] - doc: refactor the AI guidelines (Joyee Cheung) #65269
[397b58e113] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583
[338ec94d83] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605
[f18be21b14] - doc: clarify stream direction in options.stdio note (Avocado) #65236
[f07c6acd8b] - doc: clarify signal listener behavior (Som Samantray) #65243
[8bc17b0c7a] - doc: add test reporter event lifecycle diagram (sangwook) #63780
[452e7477d4] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342
[acc1578179] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
[e7ed4361d6] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #65956
[c65fafeab4] - errors: validate constructor name (Christian Aurich) #65607
[f6b47938b7] - events: fix weak listener retention overwrite (Aryan) #64024
[a27db42c3e] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521
[f3019b522a] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #64124
[cd1011458f] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #64453
[d659dd8cd8] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #65488
[1dfb047293] - fs: handle recursive watch setup races (Filip Skokan) #65699
[bc431c8413] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #64817
[dd5662e641] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435
[ac4cf54292] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486
[7804bfbd71] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540
[ba5ca5a1a5] - fs: fix recursive watch error handling (Filip Skokan) #65635
[b71c4c0551] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #61233
[53b4700892] - http: don't destroy socket after request completes (Barath Raj) #65952
[96d4c23f17] - http: fast-forward teardown of unread messages (Matteo Collina) #65732
[742b4bf5a6] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987
[8921108175] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016
[9a2f77a3fc] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #65116
[99e41eb43a] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249
[d520b9601c] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440
[86b2497aae] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #63814
[536ccc7daf] - https: limit proxy CONNECT response headers (Matteo Collina) #64545
[fe6147832b] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #65877
[843a27782a] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818
[3f0b6d3308] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910
[0039479b4a] - lib: fix shared buffer growability validation (Filip Skokan) #65845
[e7907130ae] - lib: use Web IDL interface brand checks (Filip Skokan) #65846
[7ae085552b] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #66014
[01032f4fdc] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #58842
[60a9a28206] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #65838
[230a7fcef0] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857
[7cc02b14ec] - lib: validate sequence iterator objects (Filip Skokan) #65844
[c2bb3aeccc] - lib: defer source map payload decoding until first use (Shelley Vohr) #65490
[c4b390cf17] - lib: optimize async context frame activation (Tim Perry) #65519
[3e4fc50a4f] - lib: use validateArray for array arguments (JunHwan Choi) #65344
[b351ac9cd4] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #66044
[693e890fec] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046
[9c2abc13c2] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #66048
[b3c5c2b91d] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #66049
[2428b13b02] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050
[eff5d15041] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #65965
[aa549fed0d] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962
[593b40eb2b] - meta: add web-standards as webidl owners (Filip Skokan) #65856
[e711d3fef3] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718
[0fc8a38f5b] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738
[2ca2fd566d] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714
[325709818e] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717
[8481d22f72] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720
[cd2bd5d9fd] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721
[fdec747105] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722
[34c2fca088] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723
[46d4549938] - meta: document collaborator automation (Filip Skokan) #65671
[a7f8de6362] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[466f1f8e62] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125
[cd04cb10d6] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #63619
[d983942636] - node-api: make object property arrays const (Yilong Li) #65621
[cc124394cc] - path: remove StringPrototypeCharCodeAt from some methods of posix (Wiyeong Seo) #54668
[60c3eb61bd] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[6b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[8aa870940c] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #65985
[9cfbfae660] - perf_hooks: validate import normalization offset (Matteo Collina) #65950
[75456a3512] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[127cb31864] - perf_hooks: add missing resource timing attributes (greenhead) #65017
[72d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[847fe4d049] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431
[fa9188bd63] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #65970
[ee80beaa9f] - quic: fix crash in onStreamClose (Marten Richter) #65861
[98486dd764] - quic: reject zero addressLRUSize (Christian Aurich) #65827
[97516fc256] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688
[024bef25eb] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315
[5468337456] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410
[a794e36970] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #66026
[f58a55b8d0] - sqlite: add diagnostic channel (Guilherme Araújo) #62241
[be849bc6af] - sqlite: reject connection access from authorizer callbacks (Trevor Burnham) #65156
[41161dda87] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
[adbc757d70] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
[b7b18fdbc9] - sqlite: run backup completion in callback scope (Filip Skokan) #65666
[59827acd7f] - sqlite: isolate applyChangeset filter errors (Trivikram Kamat) #64823
[5a01df2d15] - sqlite: reject deserialize() while in a callback (Trivikram Kamat) #64796
[c9b6e75a2e] - sqlite: refactor error helpers and user function pointers (Ali Hassan) #62794
[d4eb6c62a9] - sqlite: prevent database close during callbacks (Matteo Collina) #64743
[83b3431c25] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778
[13ed7e35e7] - src: list scripts when --run has no command (James Ross) #64606
[0f62f2b2df] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991
[70117640f7] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #65054
[64649abfd4] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #65779
[3c814e8c3c] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819
[a3ababcebb] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #65820
[7331f5cfcc] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #65792
[5570a84048] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #65630
[abe1b673e9] - src: keep global list of addon-provided cleanup hooks (Anna Henningsen) #63985
[2203ac9382] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #65684
[b282765d99] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520
[61ca3ba93c] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #65407
[33b8d6e10f] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327
[49232db71e] - src: reuse cached strings in CompileSerializeMain (agape1225) #65453
[e3f52b80a5] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517
[42a5a19027] - src: shave about 20 bytes off each TLSWrap instance (James M Snell) #65144
[a06bb51e22] - src: use UTF-8 for task runner filesystem paths (Archkon) #64868
[241339f072] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[1260642ace] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #65963
[5f06defdbd] - stream: make share budget failures detach before throwing (James M Snell) #66028
[d1c60d898d] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #66028
[bbb00558c5] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625
[3216bc3912] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625
[70c1415686] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #65727
[f8737b8ee5] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773
[faa16f671c] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #65847
[6262e0b8c6] - stream: create write request objects lazily (Matteo Collina) #64455
[0f0566de15] - stream: allocate stream read buffers from a slab (Matteo Collina) #64455
[02c776a7c6] - stream: ensure that stateful transforms preserve this (James M Snell) #65658
[4b29051971] - stream: fix nested async flushing with infinite sources (James M Snell) #65658
[2e54186d97] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658
[fd68d5ca6a] - stream: apply source normalization once at call time (James M Snell) #65658
[49ee85b462] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658
[d7d0440f08] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #65658
[6d8e643ef3] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658
[a082916c00] - stream: ensure factory signals remain active through closing (James M Snell) #65658
[38829295a7] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina) #65749
[d535859c22] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #65548
[80568f6818] - stream: address stream/iter review feedback (James M Snell) #65652
[6952928f68] - stream: replace object sentinel with symbol (James M Snell) #65652
[9c22c4124c] - stream: cancel active stream/iter pulls (James M Snell) #65652
[24d87990cf] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #65652
[1e215c4b51] - stream: ensure full-close semantics when closed (James M Snell) #65652
[f499d6fadf] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #65652
[2130738033] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #65652
[748adc6275] - stream: fixup cancelation handling in pull() (James M Snell) #65652
[47b3f6a1fa] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633
[6dab5412cf] - test: skip RSA-PSS keygen deprecation tests with BoringSSL (Shelley Vohr) #65808
[95d9a25b61] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108
[612db6d5b2] - test: deflake user timing WPT assertions (Filip Skokan) #66036
[61a73d31eb] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983
[d9f4a3ee3e] - test: reuse fixed primes in DH tests (Filip Skokan) #65980
[a0fd0a8bd6] - test: use named parameters in DH stress test (Filip Skokan) #65980
[810a6b00ee] - test: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) #64960
[dc6b9ba5b2] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035
[0f27bd2459] - test: unskip test-watch-create-isolation-none (Antoine du Hamel) #66041
[1019f624f3] - test: deflake util.throttle tests (Filip Skokan) #66034
[b4a6719f37] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825
[047d7c53d2] - test: implement low-risk test optimizations (James M Snell) #65926
[33775d2bbb] - test: prevent parser reuse across close scenarios (Filip Skokan) #66017
[b8c5283cbc] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008
[13a2982002] - test: improve sequential test performance (James M Snell) #65928
[a578933da0] - test: overlap SLH-DSA signature checks (Filip Skokan) #65980
[bfdf20729d] - test: unref cancelled broadcast source timer (Filip Skokan) #65980
[b29154d471] - test: collect timeout signals explicitly (Filip Skokan) #65980
[384d4fe3ea] - test: skip retries in DNS timeout coverage (Filip Skokan) #65980
[c7323843f4] - test: synchronize ordered runner events (Filip Skokan) #65980
[625290573a] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980
[2bde68398f] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980
[4c702e401b] - test: deflake node-api test-free-called (Christian Aurich) #65948
[0b6d945ebc] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906
[e04210b383] - test: try fixing windows build replacing WMIC (James M Snell) #65949
[aed73444de] - test: fix flaky cleanup in http2 test (Tim Perry) #65701
[22f47ff728] - test: update WPT WebCrypto, WebIDL and interfaces (Filip Skokan) #65679
[f2af511a24] - test: zero-fill buffers before the string length limit check (Christian Aurich) #65755
[a28aad9960] - test: update WPT for url to c23755a144 (Node.js GitHub Bot) #65651
[ba65bb149a] - test: fix recursive fs.watch error fixture (Filip Skokan) #65683
[f3b9f132b1] - test: update streams WPT (Jeong SeokChan) #65638
[d2e0f2d3bd] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #65554
[7b5896c136] - test: cover Readable.from() sync iterator errors (jakecastelli) #65515
[66eafad642] - test: document WPT runner workflows (Filip Skokan) #65510
[2e2dc0f556] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #65372
[2e57caac46] - test: prefer in-memory databases in sqlite tests (Paul Bouchon) #64701
[cef908596e] - test: fix typo from funciton to function (parkhojeong) #63403
[4c7bbd4182] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780
[25c81c9eff] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #65780
[cab5dcedbe] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #65780
[db0ca93e94] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780
[1f0087040a] - test: handle EPIPE in closed channel test (Christian Aurich) #65770
[ed4e5df638] - test: deflake test-runner-coverage (Christian Aurich) #65728
[48ecb16909] - test: set type=none on IBM i for empty source (Abdirahim Musse) #65545
[554a3fba98] - test: deflake WASI poll timing checks (Filip Skokan) #65672
[91b5389430] - test: skip fs-watch-recursive-delete-race on AIX (Antoine du Hamel) #65698
[4ed0c8cc6c] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #65584
[500b98cc7d] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #65623
[099c20fcbd] - test: avoid orphaned child on Windows abort test (Kirill Saied) #65451
[fc9364fe55] - test: riscv64: skip node-api sea test (Stewart X Addison) #65569
[c9d6b5f731] - test: mark platform-specific tests as flaky (Filip Skokan) #65562
[cb93d40549] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #65762
[b4b859319d] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #65951
[b3766225e1] - test_runner: fix quote escaping in JUnit (Jihwan) #65971
[ec37f934db] - tls: propagate singleUse to the secure context (Carlos Vinicius) #66025
[21aec3f286] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105
[ffd3de2831] - tls: read the peer certificate chain without consuming it (Tony Gies) #65602
[3481ea3c43] - tls: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) #64827
[d75957f0c8] - tls: drop hand-rolled TLS client hello parser (Tim Perry) #64827
[c555ba0aeb] - tools: update tools/v8 for Python 3.13 (Richard Lau) #66109
[aafff27ebe] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102
[7a481ebd2c] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057
[b2252b4074] - tools: summarize auto-start-ci failures (Filip Skokan) #65979
[499fe73da7] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #66045
[d004d957ae] - tools: update pgo build doc for linux (Chengzhong Wu) #66024
[bfa329dbba] - tools: correct Slack action version comments (Filip Skokan) #66013
[d55d30313b] - tools: make checkout credential use explicit (Filip Skokan) #66013
[0a9e844866] - tools: pass author to commit message validator (Filip Skokan) #66012
[f5edf1cd7c] - tools: reduce test runner timing overhead (Filip Skokan) #65980
[1cb899f727] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #65931
[9a1d47bc53] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #65932
[a1649b36bc] - tools: fix commit queue error summary matching (Filip Skokan) #65913
[ff25d0a268] - tools: lint PR commit messages without approval (Filip Skokan) #65875
[ab3c2a81f4] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872
[c97d09cb4a] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #65785
[5410d94903] - tools: remove true from branch name for auto-update automation (Antoine du Hamel) #64961
[7a45a46798] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #65757
[5df6d29a24] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #65758
[8a9f89bdaa] - tools: refine contributor guidance workflow (Filip Skokan) #65745
[ed3e9a2583] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #65716
[8d4f0cf264] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700
[350b3e69bb] - tools: retry first-time contributor query (Filip Skokan) #65648
[fbbfcc499f] - tools: query first-time contributor status (Filip Skokan) #65592
[b5885fc823] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #65612
[0cdd3171c0] - tools: label PRs lacking second approval (Filip Skokan) #65538
[5240f00c2e] - tools: welcome first-time contributors (Filip Skokan) #65533
[fbde6050aa] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352
[ebc028d75d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #65954
[55db777a9a] - typings: add task_queue internal binding types (Seongeun Lee) #65662
[ac37bbe109] - typings: add timeoutInfo to TimersBinding (greenhead) #65811
[3d9177b477] - typings: add missing sea binding properties (이혜미) #65815
[b23928a1f1] - typings: add types for performance binding (Jungwon Sohn) #65574
[f67ed991a6] - typings: add encodeIntoResults to EncodingBinding (greenhead) #65350
[a1ae3dd285] - typings: add typing for permission binding (Seungmin Nam) #65385
[fc43781ee8] - typings: fix fs_event_wrap start filename type (leah-1ee) #65661
[7e6a56c367] - typings: add fs_event_wrap internal binding types (leah-1ee) #65661
[7508db2cf8] - typings: add stream_pipe internal binding types (Seongeun Lee) #65664
[1957f9a282] - typings: add profiler internal binding types (Seongeun Lee) #65660
[62ee9eef22] - typings: add ffi internal binding types (Donghoon Kang) #65734
[6cad9a6f77] - typings: update zlib binding declarations (이혜미) #65639
[54d77431e6] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #65925
[6345c6d24f] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #65498
[63b0974d9e] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[a3bbb5a26f] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899
[212f6c6c7b] - util: canonicalize namespaced tags in inspect() (René) #63257
[b44c072228] - zlib: reject invalid zstd dictionaries (James M Snell) #65867
[de1074d592] - zlib: fix zstd reset (James M Snell) #65867
[d7e7308c76] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

cbb1d625fbfa61b23fd4a949ea41c9b08bb7905fbc75403bb11d4bcca73a5566  node-v24.22.0-aix-ppc64.tar.gz
3161e384f52d95e80bbc85c7ec6fe675528790647b7a3ec71e6ea6d53ce66b29  node-v24.22.0-arm64.msi
6a9724d9b50a5f22b4816cded441b5a8d9ddae546191a5e5b7efa5a5e2ee26d5  node-v24.22.0-darwin-arm64.tar.gz
75ddfb875bbd868ebe57536f4442225f54dd10f6d2178dd439de869a5c648dc3  node-v24.22.0-darwin-arm64.tar.xz
495e3f273c645f3c4677d438304cdfc701729ea5dec5728f5c8e76a2dece4b91  node-v24.22.0-darwin-x64.tar.gz
b890d687983ddc811641f6739c3ce99d2912c58f9e44b68aa25944037b425305  node-v24.22.0-darwin-x64.tar.xz
00e9f08b9057f9f5428387a5ffd496e53f274565b40b144b7ba876700755352a  node-v24.22.0-headers.tar.gz
23485102f0159fe0aa9a485840f35ce59300a765542b71af1ecdb1f2272ef4f8  node-v24.22.0-headers.tar.xz
b7e7991d5407815adfa74a2a9cd4db683552c8ce32ff4a295c22e972849c3f5d  node-v24.22.0-linux-arm64.tar.gz
fef00bb4d36e1c50104a9775a10359beee98f162b4104dd12472c75065c6a143  node-v24.22.0-linux-arm64.tar.xz
8cba7bbf689a9b58a65e5811146ea8d01e49d07e71f7b8462e4f6ffcd7d2e7fd  node-v24.22.0-linux-ppc64le.tar.gz
edfc950d84a74b4fb4fedc8d2a569976682f6bbbf182961a4e916b7aad856013  node-v24.22.0-linux-ppc64le.tar.xz
5901718f551ffaa76e2509f2d612d5be16fa89cddfbe2d601325c10e27f2d2b6  node-v24.22.0-linux-s390x.tar.gz
ee3a16f7700188d62cd87b50fde39f8cbd8ab82f25611114e5ed6ef00d914431  node-v24.22.0-linux-s390x.tar.xz
a95a0faf28d6f7c493036f0559d6d32b7b8c79aa06e415b12782f96946844484  node-v24.22.0-linux-x64-musl.tar.gz
a8d2897df6cd50beb83b34f958b2ca32628389225b41841f2b157d83d317a867  node-v24.22.0-linux-x64-musl.tar.xz
28ea0a438de9a13bd7891fd758eee6c7819ee8af5442dfd8d45bd65e56d4228c  node-v24.22.0-linux-x64.tar.gz
cc2f601cee82d9a5a233302fe307abc600727035fd7d2c3a3571755989e95008  node-v24.22.0-linux-x64.tar.xz
905ddb9b5cd66fc537cdeb149fafbe526b95915781a588be96632c01a106bfa5  node-v24.22.0.pkg
9010e34b40beb69ee5eb8c0ee22e08da6a6c7bff16c6f8be7904638970a66c91  node-v24.22.0.tar.gz
41f97cff2c666f1f8293dc5f85c65e8dd605c16b43fd9febd49ede32ee1e0329  node-v24.22.0.tar.xz
43f6bca62fb4a8c2377d4b99dd212f613d95b04c6a0b9013440880197a6eee1d  node-v24.22.0-win-arm64.7z
3a5c209a5bc59e65b3bc0fa13ed5e166a26bd3d55332847f498b76b037408d61  node-v24.22.0-win-arm64.zip
bde54a359b563133baa3338f02d2b0d54e7d9cc7d3a9ef6b33ee72936c12ed2a  node-v24.22.0-win-x64.7z
f9683a19877e12a9b167305c8db71040d812876359de21f0d2e97c3f321f80c3  node-v24.22.0-win-x64.zip
97ebad47ad35da4b59182a5fbe9fad2b1a1836f1042b4833ff5b4b9571175088  node-v24.22.0-x64.msi
df4b0e71e4e4d022bf8582fbe75f6061feb9c4a111a86f3fec6300d24b6fe5e0  win-arm64/node.exe
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d  win-arm64/node.lib
8b2980b4de5b7e1de222ca08e2247653364d93009a1b0139f4dbe0c1d9e23a82  win-arm64/node_pdb.7z
ddf11b66f879396e3c8977e5503c3e2db13c8fd8bcc88509dc787d298a39c8ba  win-arm64/node_pdb.zip
ba93f9a70bd86fce3ebbb39ec758501458453467aa92a34a0a3602d1e3fc2b9c  win-x64/node.exe
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7  win-x64/node.lib
d214942d0afd485966667969cf1b57598389aa86cc018608a083bb8fb4a5850b  win-x64/node_pdb.7z
60bf42213661a8b42328e93b08585ee8f55f9f47c94a1d71650c5978fcd034bd  win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEyC+jrhy+3Gvka5NgxDzsRcF6uTwFAmrPm24ACgkQxDzsRcF6
uTyCtRAAiGwdyUEPfimk5go6Nbj9ccjYaFYp8x4tHZ9M6NMMi4iTN+e773SVKDNJ
wri/PTXnKRvalMYnCmpgiIS72C3LOg51BpfEMQm9NKwIzHw7o5T9CTahw3oj487F
b5NqtdmJsidXKFBPe4ISybjSKUkD5ppfMs3bJUFxl4RZit+OB1H28jVETaLtQSD4
Yx153pRHxH/IvNKHba1G+CPabrRp6gN4anZ6OUqNSmXCK3HFisJ+LlC9dd3eDKGY
g/N+6E3F2G8OHc23Pfss3vo291I2V9wdRE0kpYvYtD8fGT7rZj7wfREtSJxxYDmj
PE1sImAGTEnRa1yucLQJ5oN4p1U0puyfPwHc07qZ8dmS32TVvCCWsdRPy1D1vwUV
2N9ambN8D1AHMM8XtRJ3Z6thHMhWa8HE/hYplKB9bnkzEu45pjmzymyrVfO3P3kg
VZv676wQVuieD6+wE0nKD1KF7InqhBdAubphE8oDerkNe1Lxx8CrtGpXoHmRPwYO
EGAsjl3+wCIj9bwWsQYthqiRPr5iGWa19L6vIsHzHVAh4R5yysdO8Q4bgFJvfXad
0WNReuEodaBU9EC2umwR3CLwdWgPRtA5tY9qU7sKua21NF2NIdnQJdOMzYe1mip8
ioaZfqvx8h8PpizVVA0EImUkbR3Yra30qF3wwNdKmCmdeL54f6Q=
=vvtA
-----END PGP SIGNATURE-----

Node.js 26.12.0 (Current)

Richard Lau — Wed, 14 Oct 2026 15:23:06 GMT

Node.js 26.12.0 (Current)

Richard Lau

2026-10-14, Version 26.12.0 (Current), @richardlau

Notable Changes

[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

[30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
[adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
[2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
[4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
[493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
[e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
[a888e51062] - build: support Python 3.15 (Mike McCready) #65750
[2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
[f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
[5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
[f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
[4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
[bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
[883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
[9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
[d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
[8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
[c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
[e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652
[7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
[af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627
[f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
[1a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566
[3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
[5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
[eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
[0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
[846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
[fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
[73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
[bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
[82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
[c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
[8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
[1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
[b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
[69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
[700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
[32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
[115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592
[447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617
[1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554
[062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430
[05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534
[2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536
[83f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #66606
[6fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448
[bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565
[c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #62530
[51f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #66556
[1aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436
[dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #66553
[9648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483
[d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411
[c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #66302
[5b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #66260
[9ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463
[bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #66404
[54867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #66521
[4314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #66555
[0e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #66620
[06f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #66400
[2e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431
[cd86506bc2] - src: mark config file as stable (Marco Ippolito) #66431
[15ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #66424
[3f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #66483
[6cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #66483
[16833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483
[af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #66483
[4b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483
[f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #66483
[7ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483
[dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483
[995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #66483
[6eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #66483
[69d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #66483
[6b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #66483
[8a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #66483
[30cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #66483
[42ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483
[fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483
[e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #66473
[93596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #65598
[4ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275
[cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #66576
[30814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #65598
[20441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #66338
[9618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450
[c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #66322
[7d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322
[d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #66322
[7309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605
[da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550
[b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #66476
[3d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699
[714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469
[fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411
[dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #66528
[4760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #66445
[63c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235
[ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

34d306d13e321942f6a48c5c0b8c4e781e864cbe052cf04386ace94f5448033d  node-v26.12.0-aix-ppc64.tar.gz
bc13c50e9dd29645c3b5880ae8366c7c603fe97945ae32b4f846381fa15f5348  node-v26.12.0-arm64.msi
2a154d4a5458930e0a2d6a1ecf64eddf5a2b3e1c13636b609c2ecb042e8c4553  node-v26.12.0-darwin-arm64.tar.gz
a2e255e35347f727f29aa158c552a60140b17b6ba68719d5d6fc46c7d058aa75  node-v26.12.0-darwin-arm64.tar.xz
878ecede191c7abc1bff01d3fb81f7ed81aa1161040dba18776b8ff8593614b1  node-v26.12.0-darwin-x64.tar.gz
c04edbd7b8429acb26058dee20c915308b174b71612ebfcb7e5976d790ae47d4  node-v26.12.0-darwin-x64.tar.xz
6abd0ddeccf3ebec9abe99582710c594669ee9510a40a1d1d990133dec36a1fc  node-v26.12.0-headers.tar.gz
c30445f95c9f6e44b4cc3d5a2b5644d5195fa11a1799b4a182006072d8cb68ec  node-v26.12.0-headers.tar.xz
ec53c915c3fdd8786c5685abd25ae3fe9fba0692307f9811d7caaadea1bcaf03  node-v26.12.0-linux-arm64.tar.gz
fd6cc729fa4448c2ac27c3fca5606019ced63c65a15c152c8df03e0cbce7f4c5  node-v26.12.0-linux-arm64.tar.xz
f9350847d0732f8bcc1577417ce536f0d617f93f093c664d88f0b1e70f2cc4e4  node-v26.12.0-linux-ppc64le.tar.gz
e90a7c8a3b2e453d3be98782b0275f119334d1a780434470b5e912f1fbfdc57d  node-v26.12.0-linux-ppc64le.tar.xz
7563e026ac03f95120201e37d6074960d06610536f45aac1fa5ed87cf74ac0d4  node-v26.12.0-linux-s390x.tar.gz
a62e7e0a7aa77893646fa076ff0444aa916e57ec3554d4cfc89f68e79f10c103  node-v26.12.0-linux-s390x.tar.xz
fdaa2cf6e44ca443a374b05db121827001aa167be25676368bab9bf36c0e48d1  node-v26.12.0-linux-x64-musl.tar.gz
4eec22381cc162f55273151bdf4f434d61216bb5abc3e7a23b8ad859ee5827c7  node-v26.12.0-linux-x64-musl.tar.xz
d9f88af72ad34f7ddf8e67289829f1698f54b6254f7d4f54b7453117ff1a3d2c  node-v26.12.0-linux-x64.tar.gz
fd47865ecd6391ebb431fc815e01b9135bf83ded5cf373247e9331e196b7aded  node-v26.12.0-linux-x64.tar.xz
4a52bdf4a236145267143ce2cc8c058def3485a5901af055572d5f15d026cf77  node-v26.12.0.pkg
435d4e5b5e12e14819f2598710f0f637f2094b25232fdf0cc304b7c4eadeadbb  node-v26.12.0.tar.gz
ce59f9038dda0e637656fb1c36cf52c07c637922fd81d419dbba2ec129afbd35  node-v26.12.0.tar.xz
c6e88e5a0ff6afdb6dfd2c8b6dc690f14f2eafc75bf839397ff9c447fdded3a2  node-v26.12.0-win-arm64.7z
cc773b9829623e3d4fd13aef394f05010e0459273f27fb3255150f38a2577abf  node-v26.12.0-win-arm64.zip
7a43d0d5b196dcb5990712a1ff403b2858366eeb0385fcaa7cbf27088dbb23d4  node-v26.12.0-win-x64.7z
50efaf01a08c520b4bbe499c09a8c5a5c370002c419c0d9da2c6815d3066a453  node-v26.12.0-win-x64.zip
dd72e3693abed70b7cb5c528dc6eaa46e628a25cd82319fb2c1ccb4462cce633  node-v26.12.0-x64.msi
141c9ed6c662e848aecdf2f3540ad5a9a7d97d51bca300e9e1a9c308f4e1cf93  win-arm64/node.exe
45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f  win-arm64/node.lib
176fc7eda8c6ae75f073200fc2d2cb2d03a4b4ed2d7822c76750c00d0c7c99eb  win-arm64/node_pdb.7z
32ef09e9e7b5829bba3190b64ee603555ea91c85bab75fa8084e0fd7130eb7ab  win-arm64/node_pdb.zip
1a14457b043fe82fd2fc027959595e91d138a8185c7ca6c02c15c16632b51aa4  win-x64/node.exe
caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f  win-x64/node.lib
598c8b6c1ae03a3f24f4ff8d395313e25e3c386efd1c4cb00d45efd9ca57cf1a  win-x64/node_pdb.7z
63043620be735731e016e35189dff6d80dc6e1b534bcbf4a79814f8b9f6b983a  win-x64/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEyC+jrhy+3Gvka5NgxDzsRcF6uTwFAmrPnfwACgkQxDzsRcF6
uTxseBAAurwha0uv70sp0lvJVcxitj+7zhb5Fa1jK1/njAlKRc2N9ZAwji2tdhZC
GwAtNmhd9Z+hwWrpi/8YEQy3kMfi3QpAVAm7nxzD7CBiFEeURP21VADpwKDtJp1R
fue5K7sGli2M07B7/8sgndj5ddGYcRqfWds0LWKbdp3Ws+mlnh9/wF5zUtYt1tne
yur2IZD+qEFqVqnJT54lu4WCGrllUgbH5t1nQP+oIRrSJDgj6VfLKpAHTBT0Qu1n
osZvnktriYkYp7v86DXh/n8/2G8H7AaZv44lNmMZ90UiCSSu7bheyzqCL4p2COWD
52uDac6oM7/zZJ0JD8yJrkL8jKFfIqapwkcUkXyBjR6MN2oyn/KzKUFOPkKh7NU4
Uji0AYs4BFsRWfzVD7WH5AIDiES2Aw44O3sAWViQnUzAuIT9TtOxYwpujj/aMXa4
7jtGsxFutRqY327+RLfPRGjXoLvF3Qg8GEyNLMBezb9LnTqNf3mDkO8qbobqXhzu
JswodLLEQdwMwvFOr2m+HIqWwM5aACBElFnsTJWUtS77xOjjNqUSCgpPLb0zDgMJ
OiGqyyFjM3MU7KgTStvnLyTJ8+Xr39lNUQVxWvS/VI+NQ7OsXzu6wYAin1DyUJgN
UmnEdFrLhtgagqGZQGoJ933D9RwNIdQoyqLePsEWVL3GgOxHGDU=
=9EZ3
-----END PGP SIGNATURE-----

Node.js 24.22.0 (LTS)Node.js 26.11.1 (Current)

Wednesday, October 21, 2026 Security Releases

The Node.js Project — Wed, 14 Oct 2026 03:00:00 GMT

Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners

Wednesday, October 21, 2026 Security Releases

TNJP

The Node.js Project

Summary

The Node.js project will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, October 21, 2026 in order to address security vulnerabilities.

The highest severity issue fixed in this release is HIGH.

Impact

The highest severity issue fixed in the 26.x release line is HIGH.
The highest severity issue fixed in the 24.x release line is HIGH.
The highest severity issue fixed in the 22.x release line is HIGH.

It's important to note that End-of-Life versions are always affected when a security release occurs. To ensure your system's security, please use an up-to-date version as outlined in our Release Schedule.

Release timing

Releases will be available on, or shortly after, Wednesday, October 21, 2026.

Contact and future updates

The current Node.js security policy can be found at https://nodejs.org/en/security/. Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.

Wednesday, July 29, 2026 Security Releases

Node.js 26.11.1 (Current)

Antoine du Hamel — Wed, 07 Oct 2026 23:56:26 GMT

Node.js 26.11.1 (Current)

ADH

Antoine du Hamel

2026-10-07, Version 26.11.1 (Current), @aduh95

Commits

[2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
[3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
[173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

3fe26a2a83d7073fe1833d4b6eef54b344ee7bbb8a88d76619a7b4b0bef302b0  node-v26.11.1-aix-ppc64.tar.gz
0c6b692d5c084f08dc44ba8f96ec21e45b120beb493943e3976e089e293140ed  node-v26.11.1-arm64.msi
d916511b55965e91be7a88e17f88d895b6793ceaba3e6c9b194aefe51c2c65ac  node-v26.11.1-darwin-arm64.tar.gz
0ef9b443000681bffc062ec126d53f97933ea9b086ea73dcba0480d87e639b39  node-v26.11.1-darwin-arm64.tar.xz
9a8129bd9ab08039793dd1143a7aedee6b5d60ac06592ad938d8bddf36142f3a  node-v26.11.1-darwin-x64.tar.gz
68a8a4de0c46e693a261d13efb43d041fcd7386187816ef9a4b14bf60003adb2  node-v26.11.1-darwin-x64.tar.xz
9491af0ccedff76fed47e29abcd2a14f0b751a14f1e54c292f025b83bea9d480  node-v26.11.1-headers.tar.gz
bcf7a66eca8d39c5f6e0ac8e0b2140c33e017fed86b643735a2701ec72d72e72  node-v26.11.1-headers.tar.xz
170454fb022f5e9b5f6cc76c25fa32ef5100895be44eb04e92f9780591491bbf  node-v26.11.1-linux-arm64.tar.gz
0945e2cde6aa0f54d980f03874dfe5cf3a549ce714c7fb9019e591ce0accf282  node-v26.11.1-linux-arm64.tar.xz
5e4d2c8b225461b1efc551358c3d15fb66c7fa7445b84fd592df65af72b0278c  node-v26.11.1-linux-ppc64le.tar.gz
96ee3114c4215fd986ac4e935dc6edb19990865f9f2dc4333b30d14050f96d22  node-v26.11.1-linux-ppc64le.tar.xz
062b4886438ab4917c9d074b253a69d367edf3bde052b5809b02aa49a223c7bb  node-v26.11.1-linux-s390x.tar.gz
cabaa5fd10e805809f2a19661fb35a7055de444d584b346142412aa89ee55a51  node-v26.11.1-linux-s390x.tar.xz
10a28b7960b994c514cb521799cbbe53fc7a1e39b02967373e05e31ff9a78d9f  node-v26.11.1-linux-x64-musl.tar.gz
8d31c2180212503799c3c93924db216e236de769b4ca1fdfe85a33ebacae510c  node-v26.11.1-linux-x64-musl.tar.xz
15fc043a51a5783f2f4b634561091658f5a7f0e3db03f997dca3a8033a33e45b  node-v26.11.1-linux-x64.tar.gz
3883bfc73f9a680ca4eab04b196068aaaab1373ffa77d8fc1a4408222495b651  node-v26.11.1-linux-x64.tar.xz
82c03bfa061f9592cf1f7f1ab2446b0975bf544c5487ccc0b3a6eb91c0bc06e3  node-v26.11.1.pkg
9aae9ac942395f4cb1f4e3c430409f9878897573ade738e732a14a19b91b5c9c  node-v26.11.1.tar.gz
2c79a3c1095c7da4c549c84e90b2d28df5479315ab6d0aff9bc71dcf4c9df1e0  node-v26.11.1.tar.xz
b43b2118d28c9975df37772ea6c2dd1d67a05254c95d1cd576169dada8a9c855  node-v26.11.1-win-arm64.7z
8dd03add3ed431eb436306f9abe946434bce928d2bf967b04117dc3755051208  node-v26.11.1-win-arm64.zip
4264e52430ee687e774a49725ec7c32040c830c1e1106de019fde4ed36d4c06b  node-v26.11.1-win-x64.7z
97f36a8a9684ff0d3e35758b4610fef5b628a5880e96f2ccc11240e5daf9934e  node-v26.11.1-win-x64.zip
5001c8e78d39593864339fb1a8c94c1ae19809bffde71e64b473d56f1f9726d3  node-v26.11.1-x64.msi
92490b88097fd3ca715a2b3afeac33766aef35c35b3b2e27ff97fd9ccc046086  win-arm64/node.exe
45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f  win-arm64/node.lib
46c5c9afe0ff9e46d4da5c194dd23b7c669e1aea346ea28836e1340c0f0d92a3  win-arm64/node_pdb.7z
b926e7a1b817e79b15d1abf625e31d3f179e763fc7a6c05193b03c1bac9d8bd6  win-arm64/node_pdb.zip
a619e2e09eb0d50ef4c733d678b4d22689d2afef138cd67fd3fa107b535f8819  win-x64/node.exe
caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f  win-x64/node.lib
f851d8eeaee7495a79de88a267f2519a06ec6194d56731c35138d45aada654dd  win-x64/node_pdb.7z
fc6bee315e968a1621981803b99c384aab2169e6a6ef4f26e54a29df1e4a1181  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCasbbnwAKCRAgsaOQsWjT
Vr8wAP930nNT1CtHqT+Hx5sTFC9MkrgXY80qT2SrMENi6ccx7AEA49YaBKozkzA7
wMR3SKxvtMVkduWu9udHSVX+KvX85Qk=
=ULO8
-----END PGP SIGNATURE-----

Node.js 26.12.0 (Current)Node.js 26.11.0 (Current)

Node.js 26.11.0 (Current)

Antoine du Hamel — Wed, 07 Oct 2026 14:45:09 GMT

Node.js 26.11.0 (Current)

ADH

Antoine du Hamel

2026-10-07, Version 26.11.0 (Current), @aduh95

Notable Changes

[232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
[4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
[6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
[e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
[7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #65619
[e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
[ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
[1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
[f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
[291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
[6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #66213
[41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
[60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
[f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
[0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

Commits

[11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420
[168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #66358
[69182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #66316
[12e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334
[e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278
[480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257
[c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #66237
[85a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121
[d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325
[b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #65960
[27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
[9f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #66449
[0002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449
[a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475
[bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467
[9acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293
[6ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #66240
[2248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136
[49069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #66228
[9066d33aa2] - build: port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183
[1f4a8fb1cb] - build: add v8_enable_temporal_systemicu (Steven R. Loomis) #65992
[4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
[a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #65325
[9fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #66348
[53cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #66217
[32ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #66237
[67ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237
[ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237
[359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237
[e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237
[a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #66237
[7f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #66237
[75870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237
[a1bea87c6a] - crypto: report actual RSA modulus lengths (Filip Skokan) #66237
[5e04680036] - crypto: derive Argon2 without worker threads (Filip Skokan) #66237
[fe09120a0e] - crypto: create key usage arrays without species (Filip Skokan) #66237
[44a2965f5f] - crypto: minimize RSA public exponent metadata (Filip Skokan) #66237
[2f3e6dff9d] - crypto: copy derived bits without species (Filip Skokan) #66237
[d54a2b2049] - crypto: handle PBKDF2 iteration limits (Filip Skokan) #66237
[2ef6046f11] - crypto: reject duplicate unknown key usages (Filip Skokan) #66237
[2e25ae4a7a] - crypto: check RSA JWK alg with SHA-3 hashes (Filip Skokan) #66237
[0370e02e2a] - crypto: copy parameters without array species (Filip Skokan) #66237
[e042d35ca5] - crypto: convert importKey data as a union (Filip Skokan) #66237
[ff86606768] - crypto: copy detached parameters as empty (Filip Skokan) #66237
[1314d277b2] - crypto: resolve supports overloads by type (Filip Skokan) #66237
[a855a46aeb] - crypto: allow unbound SubtleCrypto.supports (Filip Skokan) #66237
[4a72c1d690] - crypto: allow short AES-GCM IVs (Filip Skokan) #66237
[2d84b7ed49] - crypto: validate normalized hash names (Filip Skokan) #66237
[6bfd3924ff] - crypto: convert getRandomValues views (Filip Skokan) #66237
[529bd18c1a] - crypto: isolate cipher job errors (Filip Skokan) #66237
[d4af11e171] - crypto: reject short AES-KW inputs (Filip Skokan) #66237
[78374c8af0] - crypto: match algorithm names as ASCII (Filip Skokan) #66237
[ab9a3f2b01] - crypto: use internal random buffer bounds (Filip Skokan) #66237
[7c9b2df87a] - crypto: use current FIPS state for availability (Filip Skokan) #66160
[55af1dcded] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
[4387cb46d2] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
[150c96ef3f] - deps: V8: cherry-pick c795f5948568 (Aviv Keller) #66380
[6b5ac2ab5d] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
[bee7e2403c] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
[7a715495f2] - deps: update lief to 1.0.0 (Node.js GitHub Bot) #66345
[f9da04958a] - deps: update zlib to 1.3.2.1-motley-456ae73 (Node.js GitHub Bot) #66330
[5c34dd970d] - deps: update undici to 8.11.2 (Node.js GitHub Bot) #66332
[fdf0572cd1] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
[6c924ee1b0] - deps: upgrade npm to 11.20.0 (npm team) #66259
[2653b2617d] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
[1d68f23e08] - deps: update googletest to 4267679b6887f349f17b01ccd70c9e3483689b25 (Node.js GitHub Bot) #66145
[c507c5ad12] - deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #65992
[8c556ab2b6] - deps: update histogram to 0.12.0 (Node.js GitHub Bot) #66494
[d3f55c7487] - diagnostics_channel: replace using with try-finally (Ayush Chaudhary) #64251
[510dfd899e] - doc: update FreeEnvironment() notes for sibling Environments (Shelley Vohr) #66239
[db2665ba17] - doc: add indexed Array.prototype properties to primordial exclusions (René) #66234
[b692079e3a] - doc: fixup and cleanup stream/iter docs (James M Snell) #66079
[9b191141a2] - doc: fix casing in util.markPromiseAsHandled section (Antoine du Hamel) #66206
[8e8c9762a8] - doc: add return type to Blocklist.isBlocklist (yuki motokane) #66181
[6c7fc98d7f] - doc: clarify Worker execArgv vs Permission Model grants (yunshingng) #66124
[9fd0a10b1e] - doc: document iterable input for AbortSignal.any (Haram Jeong) #66123
[c4508fd4c7] - doc: restore XadillaX to collaborators (Khaidi Chu) #66063
[b4ad8354f0] - doc: use Type for performanceNodeTiming.uvMetricsInfo (James M Snell) #66094
[50bc27f3c3] - doc: document the node:ffi call paths (Soul Lee) #66086
[a74a0ee748] - doc,src,test: fix typos in code comments (Noah) #66218
[6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
[215639d6ce] - events: fix addAbortListener for aborted signals (Lazizbek Ergashev) #65640
[021f7d8d98] - ffi: accept safe integer numbers for 64-bit arguments (Donghoon Kang) #66197
[53fd8e7ebb] - ffi: remove permission checks from dlclose and dlsym (Trivikram Kamat) #66426
[fa7efaf782] - ffi: validate pointer ranges in optimized calls (Trivikram Kamat) #66371
[11f80798ba] - ffi: throw on allocation failure in toArrayBuffer() (Trivikram Kamat) #66406
[c65a333648] - ffi: do not abort when a Worker stops in a callback (Trivikram Kamat) #66389
[9bdab1eca0] - ffi: reject unsafe integers as length or offset (Christian Aurich Zanettini Martins) #66216
[343a5c2915] - ffi: fix use-after-free in PrepareFunction (Trivikram Kamat) #66368
[51daf16244] - ffi: reject non-boolean copy arguments (Christian Aurich Zanettini Martins) #66219
[b901b97cbf] - ffi: use type errors for invalid signatures (Donghoon Kang) #66222
[0f6cdce998] - ffi: allocate string argument storage lazily (Soul Lee) #66178
[ee84a36f12] - ffi: avoid memcpy() with a null pointer (Christian Aurich Zanettini Martins) #66200
[da32c79034] - fs: keep timestamps of files skipped by cpSync (Christian Aurich Zanettini Martins) #66305
[e7121be408] - fs: stop recursive mkdir from retrying ENOENT forever (Marco) #66340
[99a78b0d83] - fs: fix crash on negative zero file descriptor (Christian Aurich Zanettini Martins) #65888
[8b24247be1] - fs: validate falsy openAsBlob type option (Christian Aurich Zanettini Martins) #66125
[e7d5352fa6] - fs: close file streams with fd 0 (greenhead) #66131
[f38768f0fa] - fs: close fd 0 on discarded FileHandle transfer (Christian Aurich Zanettini Martins) #66095
[6487d36873] - http: avoid dictionary-mode objects in responses (Matteo Collina) #66420
[f8d30110b6] - http: cache parser callbacks (Matteo Collina) #66152
[e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
[0bb98027e5] - http: avoid toLowerCase on the server hot path (Yagiz Nizipli) #66120
[9819b0c432] - http: normalize CONNECT request paths (Efe Karasakal) #64876
[ab93a3d51b] - http: preserve socket errors as response error causes (Khaidi Chu) #66061
[15184e8212] - http: reduce per-request allocations in the server (Matteo Collina) #65802
[7702a50e08] - (SEMVER-MINOR) http2: add new connectionWindowSize option (Tim Perry) #65619
[33e4ba358b] - https: handle invalid TLS options in proxied requests (Christian Aurich Zanettini Martins) #66096
[6f610a836b] - inspector: throw ERR_INSPECTOR_NOT_AVAILABLE without an agent (Shelley Vohr) #66239
[697980b6fc] - inspector: fix connectToMainThread() abort without parent inspector (Shelley Vohr) #65976
[37b3db91eb] - (SEMVER-MINOR) lib: fix stream loading bug in node:bench (James M Snell) #66114
[46a8a5dd65] - lib: add primitive fast path to structuredClone (Guilherme Araújo) #64190
[bec7c53400] - meta: bump github/codeql-action/analyze from 4.38.0 to 4.38.2 (dependabot[bot]) #66443
[39d721abed] - meta: bump github/codeql-action/autobuild from 4.38.0 to 4.38.2 (dependabot[bot]) #66444
[963804db4d] - meta: bump github/codeql-action/init from 4.38.0 to 4.38.2 (dependabot[bot]) #66446
[5837ef8608] - meta: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2 (dependabot[bot]) #66447
[d8109f9831] - meta: label permission model changes correctly (Rafael Gonzaga) #66208
[27f20dcaea] - meta: bump codecov/codecov-action from 7.0.0 to 7.1.0 (dependabot[bot]) #66103
[dc6ef03ab6] - module: centralize builtin exposure policies (Jungwon Sohn) #66292
[f36efeb350] - module: avoid allocating a cache key string for every require() (Samuel Attard) #63884
[9baea33509] - module: normalize package map paths (Hilary Asogwa) #66054
[354c2cc867] - net: speed up BlockList.check for strings (Yagiz Nizipli) #66166
[995a67a5ff] - net: skip IPv6 regex when the string has no colon (Yagiz Nizipli) #66165
[1c7b4feebb] - node-api: do not crash on module version mismatch (Alexey Karimov) #66019
[e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
[ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
[1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
[a6dfb3bcfd] - (SEMVER-MINOR) perf_hooks: report histogram memory to V8 (James M Snell) #66099
[f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
[e2ae016df8] - (SEMVER-MINOR) perf_hooks: add histogram export format version 2 (James M Snell) #66098
[291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
[70c269aadc] - perf_hooks: restore GC tracking after snapshot deserialization (James M Snell) #66097
[c545d044ee] - perf_hooks: track GC callback installation natively (James M Snell) #66097
[0bd9905959] - perf_hooks: fix PerformanceObserver observer count leaks (James M Snell) #66097
[8ec2a940c5] - perf_hooks: add performanceNodeTiming.uvMetricsInfoBigInt (James M Snell) #66094
[829891da14] - perf_hooks: fix truncation of uvMetricsInfo counters (James M Snell) #66094
[afa02fb69c] - process: use a class for nextTick resources (Matteo Collina) #66415
[6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref from experimental (James M Snell) #66213
[0965b28252] - querystring: speed up default parse and unescape (Yagiz Nizipli) #66175
[bd547c1176] - quic: cleanly tear down QUIC after worker.terminate() (Tim Perry) #66093
[52bbf8cb15] - report: skip unresponsive workers on process timeout (Trivikram Kamat) #66304
[702c744643] - sea: add test and update docs for import() with code cache (Ali Hassan) #62678
[a1bfb6fcda] - sea: add vfsArchive to serve the assets from a ZIP archive (Matteo Collina) #65810
[fe76deb537] - sqlite: restore connection state on reopen (Guilherme Araújo) #66042
[4977e51ff3] - sqlite: use cached strings for property keys (Kyungrae Kang) #65902
[cd16dcb82b] - sqlite: reject plans with unusable virtual table parameters (Trivikram Kamat) #66215
[33caead942] - sqlite: throw on oversized string values (Guilherme Araújo) #66209
[41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
[583ee1ce64] - sqlite: run generator return() on cursor refilter (Trivikram Kamat) #66195
[b46b6996e2] - sqlite: add virtual table support via createModule() (Trevor Burnham) #65787
[edbff8caf1] - src: fix --process-timeout message when exit waits (Trivikram Kamat) #66361
[cd814e7f23] - src: remove orphaned js_udp_wrap test binding (René) #66399
[1e9c10b8ea] - src: assert that an IsolateData outlives its Environments (Shelley Vohr) #66239
[286bffc0a1] - src: track handle cleanup per thread, not per IsolateData (Shelley Vohr) #66239
[25c08fcd0d] - src: remove HAVE_QUIC macro in favor of OPENSSL_NO_QUIC (Antoine du Hamel) #66373
[5eea87c561] - src: fix builds without SSL and SQLite (Filip Skokan) #66372
[9696e47c32] - src: reduce InternalCallbackScope overhead (Nigro Simone) #66316
[60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
[12962d8eb5] - src: fix FreeEnvironment() breaking JS in sibling Environments (Shelley Vohr) #65977
[abccf93d9f] - src: let Environments on one isolate share a cleanup hook (Shelley Vohr) #65777
[caa7858e4c] - src: fix abort when two Environments share an IsolateData (Shelley Vohr) #65978
[f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
[de34ddcf95] - src: throw on a malformed localStorage file (Trevor Burnham) #65879
[6651596663] - src: reserve shared_array_buffers capacity in Message::Deserialize (agape1225) #65304
[74835eef19] - src: ensure Socket(fd) cannot bypass allow-net permission (James M Snell) #66117
[d7c720f283] - src: add a flag to keep the embedder's wasm streaming callback (Shelley Vohr) #65690
[68931f70d9] - src: free placeholder nodes for cppgc wrappers in MemoryTracker (Shelley Vohr) #65793
[13dbf1923a] - src: fix task queue deadlock when built as C++23 (Shelley Vohr) #66066
[0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067
[158f6f78d4] - stream: share webstreams async iterator methods (Matteo Collina) #66392
[e241cb80da] - stream: keep webstreams nil requests in fast mode (Matteo Collina) #66230
[62187ab707] - stream: keep consumer state in fast mode (Matteo Collina) #66266
[dcc8665f7e] - stream: fix pipeline function tail deadlock (Dayun) #65559
[247c0274c1] - stream: skip write() checks in flowing pipe (Yagiz Nizipli) #66182
[26102c22f2] - stream: speed up flowing pipe of buffers (Yagiz Nizipli) #66182
[81e4ac47a3] - stream: support ArrayBufferView in Utf8Stream write() buffer mode (agape1225) #65301
[f7f1116fc9] - stream: fill out stream/iter test coverage (James M Snell) #66079
[dca736ba05] - stream: cleanup promise uses in stream/iter (James M Snell) #66079
[55ef82ac0c] - stream: make classic reads wake on return/throw/abort (James M Snell) #66079
[4e8df7ceee] - stream: correct strict pending-write behavior & cancellation (James M Snell) #66079
[b44b8658d3] - stream: make stream/iter toWritable apply backpressure (James M Snell) #66079
[3c9f8789c4] - stream: trim per-pipe and per-tee costs in webstreams (Matteo Collina) #66154
[d96a80930e] - stream: update ShareImpl to retain factory abort listener (James M Snell) #66030
[500b56774f] - stream: make Broadcast.from() only return the Broadcast (James M Snell) #66030
[d40236c98e] - stream: ensure streamable protocols precede fast paths (James M Snell) #66030
[cdeb53e807] - stream: have broadcast clean factory listeners on cancel (James M Snell) #66030
[84f9031add] - stream: ensure protocol and transform accessors are called once (James M Snell) #66030
[1c7c0f5267] - stream: make broadcast waiters use SafeSet (James M Snell) #66030
[9b50b629a2] - stream: ensure nested async iterators are cancellation aware (James M Snell) #66030
[a16320eb15] - stream: trim per-stream costs in webstreams (Matteo Collina) #66052
[3a77852e34] - stream,quic: correct stream/iter writer implementations (James M Snell) #66079
[6c5806b53c] - test: wait for ZIP source streams to close (Filip Skokan) #66429
[4706cafc59] - test: mark worker init failure flaky on SmartOS (Filip Skokan) #66428
[c19e2cedd2] - test: deflake process timeout report cleanup (Filip Skokan) #66428
[1047188452] - test: split process timeout report coverage (Filip Skokan) #66428
[430262ecb0] - test: do not hardcode V8 serialization header (Joyee Cheung) #66442
[7b25cb811a] - test: make histogram external memory test less overfitting (Joyee Cheung) #66416
[aead8a9019] - test: cover Environments sharing an embedder-owned isolate (Shelley Vohr) #66239
[f63ddfafdc] - test: isolate styleText tests from the environment (Filip Skokan) #66320
[a3ffd40d40] - test: probe cluster workers with signal 0 (Filip Skokan) #66320
[f59117e5fd] - test: deflake watch cwd with isolation none (Filip Skokan) #66320
[f23010d837] - test: deflake esm loader http imports (Filip Skokan) #66320
[3f51c49ff9] - test: deflake http headers timeout keepalive (Filip Skokan) #66320
[a5ee59cb00] - test: deflake http server mixed request timeouts (Filip Skokan) #66320
[7c3463901f] - test: deflake inspector close connection test (Filip Skokan) #66320
[fbdca3a120] - test: deflake debugger PID attachment and cleanup (Filip Skokan) #66320
[534561358e] - test: deflake inspector network fetch (Filip Skokan) #66320
[1ff8d5c2c9] - test: use correct constructor in test-sqlite-virtual-table (René) #66401
[de797aa4b4] - test: check frame restore in CallbackScope (Nigro Simone) #66316
[886fd32693] - test: use common.PIPE in fs.cp socket tests (Maksim Romanov) #66329
[3c50781d10] - test: deflake fast FFI buffer tests (Filip Skokan) #66327
[1d8f9a2bfb] - test: use Database in sqlite virtual table test (Trivikram Kamat) #66307
[61a87a246f] - test: deflake sliding window histogram test (James M Snell) #66132
[017ff85b82] - test: split FFI call and callback coverage (Filip Skokan) #66287
[19d8d1992c] - test: add smoke tests for defer importing synthetic modules (Maya Lekova) #65537
[fb3d90a986] - test: deflake test runner timeout coverage (Filip Skokan) #66255
[cee8eb9c74] - test: deflake inspector async hook setup (Filip Skokan) #66255
[37e9397bfe] - test: deflake debugger function name extraction (Filip Skokan) #66231
[7b1c74eec3] - test: use spawnSync helpers in cpu-prof tests (Junhwan Choi) #65694
[2fd51fd5d8] - test: reduce expensive crypto test variants (Filip Skokan) #66244
[c155248f1b] - test: ensure fsPromises.watch rejects on abort (Jihwan) #65768
[42255ab9b1] - test: avoid using promise wrapped timers (James M Snell) #66079
[62f92a5d3d] - test: enable trace_events tests with perfetto (Chengzhong Wu) #66068
[f2972bf10a] - test: accept ENOTEMPTY from libc++ in test-fs-rm (Shelley Vohr) #66065
[e0d0c5d0e2] - test: use heapdump test for SecureContext memory tracking (Mert Can Altin) #64344
[953e46789d] - test: update WPT for url to c48d58747e (Node.js GitHub Bot) #66141
[aaa7a7aebe] - test: deflake watch mode tests (Filip Skokan) #66232
[ee457cd306] - test: mark some tests flaky for now on riscv64 (Stewart X Addison) #65781
[9b432e97ca] - test: deflake pummel/test-timers (Filip Skokan) #66135
[63d32369b1] - test: update WPT for WebCryptoAPI to a6a0a0292a (Node.js GitHub Bot) #66142
[658951021a] - test: deflake test-bench-errors (Filip Skokan) #66153
[1be62ae8d5] - test: deflake test-http2-debug (Filip Skokan) #66151
[b9f61ea9ab] - test: deflake test-benchmark-crypto (Filip Skokan) #66151
[fb9aba67dd] - test: deflake long timer WPTs (Marco) #63106
[53b3a053a2] - test: update test426-fixtures to 9ea66b466fd37e8a4050033d23b3e1480973c3d (Node.js GitHub Bot) #66493
[ef1a602283] - test: update WPT for WebCryptoAPI to 3127c3a492 (Node.js GitHub Bot) #66492
[d573726238] - test_runner: do not crash on stdout that mimics a v8 frame (Muhammad Faizan Uddin) #66273
[ea2c1bbe8b] - test_runner: do not reuse a worker ID held by a running file (Vasiliy Serpokryl) #65739
[0f0892e59c] - tls: initialize session and SNI before connecting (Steven) #65624
[684cae7909] - tls: preserve CN name constraints with OpenSSL 4.1 (Filip Skokan) #65957
[df96c928a2] - tools: limit checkout for lint-cpp (Yuya Inoue) #66474
[593c96446c] - tools: limit format-cpp checkout history (Yuya Inoue) #66479
[4251b8b1f9] - tools: share CI and benchmark build configuration (Filip Skokan) #66351
[6948dd1232] - tools: fix nixpkgs updater script (Antoine du Hamel) #66337
[e3f861b23e] - tools: wait for test processes instead of polling (Matteo Collina) #66432
[14cc5877d7] - tools: avoid repeated subtree scans in must-call-assert (Yuya Inoue) #66408
[7fb76f9554] - tools: add cache to lint-js-and-md (Antoine du Hamel) #66412
[9015b992d0] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #66418
[84db29179a] - tools: bump brace-expansion from 5.0.9 to 5.0.12 in /tools/eslint (dependabot[bot]) #66417
[a952647d86] - tools: keep OpenSSL update PRs in draft until arch configs committed (René) #66398
[2d3be6adf2] - tools: update gyp-next to 0.22.3 (Node.js GitHub Bot) #66397
[5f54bc7763] - tools: fix Nix diff tools when pushing more than 1 commit (Antoine du Hamel) #66383
[2c06236669] - tools: reduce bundle size of benchmarkTools.nix (#65388) (Antoine du Hamel) #65388
[b10949cdca] - tools: add deps/LIEF to the ignore list of test-shared.yml (Antoine du Hamel) #66342
[80cd5d8143] - tools: bump the doc group in /tools/doc with 4 updates (dependabot[bot]) #66295
[aaaca48ce8] - tools: check CI availability and workload (Filip Skokan) #66280
[0607f14c3a] - tools: enable temporal by default in Nix integration (Antoine du Hamel) #66267
[605938efb3] - tools: reduce source tarball compression in CI (inoway46) #66228
[0913452391] - tools: add lief to automated dependency updates (René) #66242
[63469ca078] - tools: add resume-ci label handling (Filip Skokan) #65945
[8e79b1fa36] - typings: wire up spawn_sync internal binding types (agape1225) #65996
[0845991255] - typings: share AsyncWrap and HandleWrap types (Seongeun Lee) #66150
[e90ba99def] - typings: add mksnapshot internal binding types (Seongeun Lee) #65901
[8623a13d97] - typings: wire up quic internal binding types (agape1225) #65556
[7202aa55a7] - url: create URLSearchParams collision map lazily (Romain Lanz) #65801
[aff60171cd] - util: make mime parsing faster (James M Snell) #66369
[83a1697f1c] - util: fix inspect indentation of detached DataView (Miodrag Obradovic) #66421
[33ef1780fd] - util: show SuppressedError's error/suppressed properties on inspect (agape1225) #66159
[dbb0e6e164] - util,assert: expose util.isPartialDeepStrictEqual() (Thomas Hunter II) #66118
[afb61d6ca4] - vfs: make the reserved root readable through fs (Philipp Dunkel) #66140
[83c0e30cd7] - vfs: drop --vfs-mount, pin the load mount point (Philipp Dunkel) #66162
[9656992aff] - vfs: support recursive readdir in ZipProvider (Philipp Dunkel) #66127
[d5b65c3b94] - vfs: validate ZipProvider parent directories (Trivikram Kamat) #65829
[41e9ab96cd] - watch: escape quotes and backslashes in NODE_OPTIONS (Trivikram Kamat) #66363
[17964bb699] - watch: detect files replaced via unlink and create (Marco) #63888
[be7f637d0e] - watch: strip watch flags from NODE_OPTIONS in child process (Marco) #62143
[6c23e21c00] - worker: discard queued messages on termination (Filip Skokan) #66354
[ee51b0412f] - worker: serialize messages after exit (Filip Skokan) #66354
[c2c5f4ccbe] - worker: preserve blob module URLs (Filip Skokan) #66354
[05d533ede5] - worker: convert importScripts arguments first (Filip Skokan) #66354
[230cd0ce43] - worker: fix postMessage overload resolution (Filip Skokan) #66354
[78b502a565] - worker: add Symbol.toStringTag to BroadcastChannel (Lazizbek Ergashev) #65532
[56e6a5c8d8] - worker: add Symbol.toStringTag to MessageChannel and MessagePort (Lazizbek Ergashev) #65532
[b896580c47] - worker: remove messageerror listeners on exit (Dayun) #66075
[19732fc576] - worker: strip types in Web Worker module entries (Hubert Walczak) #66085
[bb3d33e610] - zlib: fix abort with decodeStrings: false (James Ross) #66359
[9b350d80ff] - zlib: pledge input size in async zstdCompress() (James Ross) #66358
[6c927c0009] - zlib: preserve brotli params and dictionary on reset (Xia Chao) #66157
[54e93301a1] - zlib: reject reset after gzip/deflate emitted incomplete output (Xia Chao) #66179
[d84b4550e5] - zlib: reject reset while a zstd frame is incomplete (Xia Chao) #66088

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

9fcba786b1fb2d77370158bc7df9dfbca8c7b3f977a3ae2197324eb78e08f9a8  node-v26.11.0-aix-ppc64.tar.gz
86bfeb978250c30eef85bd01c1651a98091728d3118ba3fc209f3f3f7a1069d0  node-v26.11.0-arm64.msi
1b51d948058a5a0f4d83723d395786f13a647565ca4dfdeac37dafa95040e5f3  node-v26.11.0-darwin-arm64.tar.gz
9ba071a58cc50e6f454effa70de1b2c9e853e2c98c9ee65e5dfd3601041fc064  node-v26.11.0-darwin-arm64.tar.xz
dcc3cdaa71744ebce8db2c5005e791eb27e214818a5289f4dd520a7321160297  node-v26.11.0-darwin-x64.tar.gz
052517dc6e6127d08a8441d38b6cfbfc8972e89b5b7d287792f8ccb05887dfcc  node-v26.11.0-darwin-x64.tar.xz
b99396d1721ae64db1b615da88bd758947e12f4cd101a5ce0222a3b4b7e25409  node-v26.11.0-headers.tar.gz
4d9f9d5fd1ed63b4023bdb951cf73003f11c8df8c2e0f08096b94040db098d00  node-v26.11.0-headers.tar.xz
990bbeaf592bfae995def6c5b43b89bb5ddd222305c91251e3b9d9bfc7c120bc  node-v26.11.0-linux-arm64.tar.gz
81a3cca833d080354236b5411a49003db8848ee003b122e212b88038692f7a11  node-v26.11.0-linux-arm64.tar.xz
e142924db4aa9815627fdb3028b9c592c814acf4fe3523e4e8b10ddcbe2123a8  node-v26.11.0-linux-ppc64le.tar.gz
46ace9f157b59530f2c6aece2f4d74846dce4295cadb082ef951030c9965ac59  node-v26.11.0-linux-ppc64le.tar.xz
d9e84f29547f6d3071e0c81de9f85dd7b1d311ea0e0bd20f3c39a9e4411c13f2  node-v26.11.0-linux-s390x.tar.gz
d1e9ac1d6bdcdcf4ac2f0bc790838542cc071fba72daba000ac2b87490996d96  node-v26.11.0-linux-s390x.tar.xz
cda111a092e7f5d68bf02b7bffe977f0e0a3233297d754c1e966db7e53085bf0  node-v26.11.0-linux-x64-musl.tar.gz
a08950a851f22b5e81aff8fd7a75f4bba9910be24d0fc24032a947c43f300566  node-v26.11.0-linux-x64-musl.tar.xz
2dcdf1a51a055e3ac1027ce5a01c2409ec7fa016b99e25e58a939568a9e0b6ad  node-v26.11.0-linux-x64.tar.gz
db6342d36ebdb3cbd72103d0ce5ccc528620f6c9df72a11f4ccb384bf1bef678  node-v26.11.0-linux-x64.tar.xz
994cf7dcd044781f1ab67190ba30da16d8d48d81f111edb81c0845ea24a79142  node-v26.11.0.pkg
a27eb1de6de47df41e376a3429b59bdc9b6c26a800598aa9a58d9c59540c8dc8  node-v26.11.0.tar.gz
aaad9242704524109e88d48be7bb7b7943486d931e740a352c02e97e107f18c9  node-v26.11.0.tar.xz
d495084d34efff0af03928f32f90d7d7b6a0f44a50c5a4a1e4f3396671102822  node-v26.11.0-win-arm64.7z
0b393a20f50f9a0f475e959e8a8dcc7fdceaa8ae322afa18a94c059c2ecd98cb  node-v26.11.0-win-arm64.zip
fd5663935751863e5cb86918b2683f501c7566012f03d4bf8712005467cbcb30  node-v26.11.0-win-x64.7z
d8a6a09949bc9d0535088d3e4859a5f833fe47d3cdff63edb5e0f483196c830d  node-v26.11.0-win-x64.zip
d5911c23ed68bd2686128760b9e768f818b1c077cfe7ddbf5275547204741696  node-v26.11.0-x64.msi
422d3ea65b7fbca370755423c7847a97504d1762c245d1c43d9524d6ee126df2  win-arm64/node.exe
45084cbfc0170d7a30b29ab1eeeb2b0d770995ade0a13a4cc82cf31189f95c9f  win-arm64/node.lib
3d99512f080bfb0627c1d09360e0b6eb9a05da09d74be2f393564c8edf7ee1d7  win-arm64/node_pdb.7z
a9df2168e32a898694057461549ec6ad1c5a5907a25af4e5443675c023d92880  win-arm64/node_pdb.zip
a4d0a5e97ef053be02dd200ba581d9ccf5233057a36c9b3dbe4f16c6cf586485  win-x64/node.exe
caad0090dc3add94c06abd01e395e8ec0f1586c10071bda1f99480445d695f6f  win-x64/node.lib
2b16befd4d2556d38ebabfa964b9a56157cc807b34a1998b04f674a1a4489351  win-x64/node_pdb.7z
55347d1f733225a9e8e6a3404ffeb555f138dff09b9a5d9d263577cc8c51cdb5  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCasZajAAKCRAgsaOQsWjT
VsgjAPsGPZul87MDU7lnNO7MU98b12o0f3NOxpOsG6Sl1BrxqAD+ILbFuIBJl3Gp
zVeHtzD1k8IKJOwJLKvOfQ1c2COGMAc=
=OWqU
-----END PGP SIGNATURE-----

Node.js 26.11.1 (Current)Node.js 22.23.3 (LTS)

Node.js 22.23.3 (LTS)

Antoine du Hamel — Wed, 23 Sep 2026 18:22:40 GMT

Node.js 22.23.3 (LTS)

ADH

Antoine du Hamel

2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbol

Notable Changes

[fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
[b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
[e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
[a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #65542
[2a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #65790
[3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
[66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623

Commits

[44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
[fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[71feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
[871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
[2a3548e51c] - deps: update undici to 6.28.1 (mcollina) #65790
[59d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
[a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
[3376e27de2] - deps: V8: cherry-pick a6eaf7574109 (Camillo Bruni) #65402
[b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
[4e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
[7d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
[01855a19d3] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
[23fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375
[5286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
[6d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
[e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
[d9cb8468a3] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
[c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
[37f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
[7c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166
[3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
[66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
[ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217
[839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #65629
[40eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542
[75098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065
[08b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627
[02cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #62993
[6f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753
[bc5753d438] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
[d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
[38ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
[fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
[e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961
[5fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651
[ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

b85dc5f0d7a9be8038c4e73450d9125b241c792ec7ec495229345f86d1e3f6fa  node-v22.23.3-aix-ppc64.tar.gz
a6fcbecafce9c8fbf86ffcb5fb12a66af5f465c449ef5e2fcf7c4e651c1a9b14  node-v22.23.3-arm64.msi
23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53  node-v22.23.3-darwin-arm64.tar.gz
72d5d8832b41c9d9646197af614ffd751406ea4d215060eb91b98864e1919a3e  node-v22.23.3-darwin-arm64.tar.xz
8a677b0219178efd6eb0e475457c4afb452b521a92f6e67845a73bd85727f2a8  node-v22.23.3-darwin-x64.tar.gz
ac41874c3352937119cfec39e1a98c578fe58ce8a86d7e785b89a4706015f305  node-v22.23.3-darwin-x64.tar.xz
eff1a7e67736bdf25db421ddaa613ed605f751a7b9fe07fb473ea880d1348987  node-v22.23.3-headers.tar.gz
8448fe9f94d65aece4df26f266358644d6f41da4ce23aab09675e206edcff1d4  node-v22.23.3-headers.tar.xz
5ced2d48d1d7198739b7f86804de0171aefb6823b684b12341d3321afc3cb0b2  node-v22.23.3-linux-arm64.tar.gz
a44aeb94849a299b22df10b9e622ec2f605c2183501bc40590705131de7c740f  node-v22.23.3-linux-arm64.tar.xz
8b99058ec6f4e372b9887f8ecb577a292adb132d59e5104356428a758fdb126c  node-v22.23.3-linux-armv7l.tar.gz
590a2768199bdd0b848648a81cd7f07f88a5ceb27949f0c70d5e6652c3eaca69  node-v22.23.3-linux-armv7l.tar.xz
236712ddef73f56c0e0590a2c49f69c8393a2c2d82c3d62c7c165605b472b38d  node-v22.23.3-linux-ppc64le.tar.gz
0214e542c73686134856784c0cbd2762b5414097640762b4afc2e33e6e499207  node-v22.23.3-linux-ppc64le.tar.xz
51f64794f5f61bdfc80aa186c8273021473997605cf90ed31ed148bee650a554  node-v22.23.3-linux-s390x.tar.gz
a311c8f0b352e7dedc13958b612ac190a56456fc837dd26cd5e5845713a1eb1d  node-v22.23.3-linux-s390x.tar.xz
633f49a4f388c5f9564d56d9c0f5ffa394346d92ca0076fe21cf776ece1988bc  node-v22.23.3-linux-x64-musl.tar.gz
0564c678817e6b6fd7860689283185cecdf42e644135b45636094757b9a7922b  node-v22.23.3-linux-x64-musl.tar.xz
1084aa36196bba4c3a5e69a1ee388a6e4ff729dad09445fbcd434b28fe3c24af  node-v22.23.3-linux-x64.tar.gz
df450af89261115ef9f9e3830c3eeb2cc9213b63c720b1af623cb5dcbe2e02de  node-v22.23.3-linux-x64.tar.xz
55c853a53b4bf88c1d8fd70e6add0b22b49c0e76352d4044caaa90512734ab7e  node-v22.23.3.pkg
9436c81b284889303d39f5b8bd629bf19e790c665ccb94b4994aa87220d9799a  node-v22.23.3.tar.gz
bd97093e1a1e9243338950c174a693a64d4e0926a9c6ce259962bc58d5e96909  node-v22.23.3.tar.xz
33fbc3458ce5cddd694f319bcb47490fbce720c492e25573b594e205c189c89a  node-v22.23.3-win-arm64.7z
33dad22e4cef5ee8f9fbb1b0d037fdacd0e56d12a4580f0d63f68b894deab535  node-v22.23.3-win-arm64.zip
fa7a98510f2edf181733dee15a200a5039a0459511366150e4c64da72a53ab94  node-v22.23.3-win-x64.7z
2b0ff57b049cda1bbcea2240eec20467018713c1efe1f7360c2681859b90ed71  node-v22.23.3-win-x64.zip
ff5ffeb0cc42d76b4bfe453638dbe9a69738fdaec967a14cd84f3b11225bb523  node-v22.23.3-win-x86.7z
1e07ac00e61b41b7ecf242de8e38883d237d5ad3fdcad7c16f2dd3a88670e2b6  node-v22.23.3-win-x86.zip
1c0efc8449987e7da5d184786a0a96da83ffa11d334421201e5c09b93017cb8d  node-v22.23.3-x64.msi
c71bbe31029c99d6f9cffa4841056ecc49dcd1fb09ef739b7e85dc7b207242b4  node-v22.23.3-x86.msi
b5a3165ec6f24c0b1fe2a10fed58e03f6c1d7d141beb3b225ff030ceac6c5eb5  win-arm64/node.exe
5378f5bad777b4929d1cd4f58974e0ef03815ce5c159863f1875c4b434460c27  win-arm64/node.lib
3f21d9cee58b7168ee46827e04d381dcdeb2d1cc5974bc226ba3a1bcd6bf8988  win-arm64/node_pdb.7z
bb155f2ecad21c98cd909831cb26320e123dd010a654f3649e8ba54a7de9f433  win-arm64/node_pdb.zip
9c9245166b4a8e182e0b797da9c20136117ff24368eaff1fec8343a123c8db0e  win-x64/node.exe
c243185f2347870cadb637c909bf123fc703dc65dbfa769b17ec45a4b661d782  win-x64/node.lib
1babb45798cf3a2d4e70574ba926e7ff26b71487ed940a98cdd4971f32af4cae  win-x64/node_pdb.7z
ab9fe384f04575fab7b2915b02d109a1d415b184cd6b28239fdb67e12c260321  win-x64/node_pdb.zip
a8aa72dda43af5357d0a502548a54e402d4f7643be221662624a2cc876cd37bb  win-x86/node.exe
eff47cc18fe2d3e40886cd49f04a85134681657d8b0f2afc55f363743cf6ddd7  win-x86/node.lib
18963f55b0ebda23c72ab023990e68bce5302645f9643b6f0ac52dc809e3c501  win-x86/node_pdb.7z
95d75dce4db28836ef7ff2ddada21c1df67cc07f7d9a727ac38b021ee3afdeaa  win-x86/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCarQJ5gAKCRAgsaOQsWjT
Vi6XAQD18cb42T8Iokdj3jgAfoB41fqECt7DeN43VsgOoSNDZwEAxqn3W+nDSkFo
aQyV6A9gETWcFz27zSzMVA+vDrzbvQM=
=2yJE
-----END PGP SIGNATURE-----

Node.js 26.11.0 (Current)Node.js 26.10.0 (Current)