Product overview
Node.js is a free, open-source, cross-platform JavaScript runtime for running JavaScript outside a web browser.
Main capabilities Event-driven network applications Web servers and application programming interfaces Command-line tools, scripts and build tooling Typical use Web backends, APIs, real-time services, developer tooling and automation.
Deployment Installed directly on a host or deployed with applications in containers, functions and managed runtimes.
Description source: Node.js project overview ↗ · reviewed 22 Sep 2026
Phase Start End State Coverage and conditions
Active LTS 29 October 2024day precision 20 October 2025day precision confirmed Active LTS maintenanceConditions: Release working group schedule Maintenance LTS 21 October 2025day precision 30 April 2027day precision announced Maintenance and security fixesConditions: Dates are subject to change
Release notes Version-specific publisher information
Release notes describe changes in this version. Their publication dates are not treated as support or retirement boundaries.
Release-note research has not completed for this version.
Publisher updates and known issues CVE Intelligence enrichment
These records add release notes, security advisories and known-issue context. Their publication dates are not lifecycle boundaries.
OPENJS FOUNDATION NODEJS-22.23.4
2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95 This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update sqlite to 3.53.4 (Node.js GitHub Bot) deps: update undici to 6.29.1 (Node.js GitHub Bot) Commits [ 68fa0df6d6 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ dd6b47573b ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ a62b7d5362 ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 [ ec9e5e4a3e ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ a538a9515d ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 67d294739f ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ 1ab9db8a74 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ 52b4bcab03 ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ 60f4833d41 ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 05470dc308 ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 47333fe4f4 ] - deps : update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 [ 98258b855f ] - deps : update sqlite to 3.53.3 (Node.js GitHub Bot) #64180 [ a8349b6408 ] - deps : update sqlite to 3.53.2 (Node.js GitHub Bot) #63774 [ e9e295bcc1 ] - deps : cherry-pick e807d4e379 from SQLite (Junsu Han) #63525 [ 512a9b61f0 ] - deps : update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 [ e708247254 ] - deps : update sqlite to 3.53.0 (Node.js GitHub Bot) #62699 [ 857be5afa3 ] - deps : update undici to 6.29.1 (Node.js GitHub Bot) #66765 [ 19c5056002 ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ e7b2985d59 ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 50ab804edc ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ a18ec92752 ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 4342503fd8 ] - tls : reject chains containing blocked public keys (Ulises Gascon) #66871 [ d7663560ac ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ beb4cd4cd3 ] - tls : match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145 [ 4b42e56aaf ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-22.23.5
2026-11-11, Version 22.23.5 'Jod' (LTS), @aduh95 This is a security release. Notable Changes ( CVE-2026-123863 ) http2: release headers when a stream is removed (Matteo Collina) – High ( CVE-2026-123864 ) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High ( CVE-2026-123865 ) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High ( CVE-2026-123866 ) http2: retain buffers until socket writes finish (Matteo Collina) – High ( CVE-2026-123872 ) tls: disable resumption for mTLS with no session id context (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow TLS resumption to change SNI (Tim Perry) – High ( CVE-2026-123874 ) http2: retain streams during pending writes (Matteo Collina) – High ( CVE-2026-123828 ) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium ( CVE-2026-123867 ) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium ( CVE-2026-123868 ) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium ( CVE-2026-123871 ) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium ( CVE-2026-123875 ) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium ( CVE-2026-123877 ) https: isolate Agent TLS policy keys (Matteo Collina) – Medium ( CVE-2026-123829 ) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low ( CVE-2026-123862 ) zlib: handle params callback after destroy (Matteo Collina) – Low (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low deps: update llhttp to 9.4.4 (Antoine du Hamel) deps: update sqlite to 3.54.1 (Node.js GitHub Bot) Commits [ 554fff40f0 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ 6577cbf231 ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 [ 61d93c6086 ] - deps : update sqlite to 3.54.0 (Node.js GitHub Bot) #66663 [ cd18f6bdff ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 [ 6cd7e80d68 ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 [ 9bce421783 ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 [ 30fd852c0d ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641 [ 21fb5d0348 ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252 [ af6fbb6564 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 [ 5c9eed3b1e ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 [ 5e497aec89 ] - src : fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986 [ 06af164d09 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030 [ 209c7e4d83 ] - tls : don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030 [ 05e452f075 ] - tls : don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030 [ 67da864a89 ] - tls : apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020 [ c841c6c7f1 ] - tls,http : prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021 [ ea159e84dd ] - zlib : handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.22.1
2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95 This is a security release. Notable Changes ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) ( CVE-2026-105483 ) tls: fix ip normalization regression (James M Snell) ( CVE-2026-106069 ) tls: reject non-canonical IP addresses (Matteo Collina) ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) deps: update timezone to 2026e (Node.js GitHub Bot) deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) deps: update undici to 7.30.1 (Node.js GitHub Bot) Commits [ 2a73ee5a89 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ 4d6990b33c ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ 4b3c9bbf9f ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007 [ 9243b105b6 ] - crypto : update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496 [ 1e39cd53c7 ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ 49dff6f57a ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ fca511adc5 ] - deps : V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008 [ 18711c7567 ] - deps : update timezone to 2026e (Node.js GitHub Bot) #66419 [ fa77cfb1ad ] - deps : update timezone to 2026d (Node.js GitHub Bot) #66333 [ b84f9f186b ] - deps : update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396 [ ff0664c3ba ] - deps : upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396 [ 1d4c89ef87 ] - deps : update undici to 7.30.1 (Node.js GitHub Bot) #66764 [ 843a1627dc ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ 96c3ccb1fc ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ 8dc18a6218 ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ b5f41529df ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ 01acf0ee74 ] - tls : reject chains containing blocked public keys (Ulises Gascón) #66871 [ 935918e342 ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ de49c913f2 ] - tls : fix ip normalization regression (James M Snell) nodejs-private/node-private#985 [ 9dc4bb57f0 ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.22.2
2026-10-28, Version 24.22.2 'Krypton' (LTS), @aduh95 Commits [ f8bdcd54ed ] - deps : V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249 [ 3b93fd6b2b ] - deps : V8: backport 1a0089053443 (Jakob Linke) #65764 [ 5aaf62faaa ] - deps : V8: backport c9c0abfa51f0 (Jakob Linke) #65764 [ 3b8eb1a920 ] - deps : V8: backport ebd15783b7ba (Marja Hölttä) #65764 [ ab70b5d681 ] - deps : V8: cherry-pick 853553fe755c (Victor Gomes) #66241 [ 17ec999f24 ] - stream : keep async context of parked writes (Matteo Collina) #66907
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.22.3
2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95 This is a security release. Notable Changes ( CVE-2026-123863 ) http2: release headers when a stream is removed (Matteo Collina) – High ( CVE-2026-123864 ) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High ( CVE-2026-123865 ) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High ( CVE-2026-123866 ) http2: retain buffers until socket writes finish (Matteo Collina) – High ( CVE-2026-123872 ) tls: disable resumption for mTLS with no session id context (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow TLS resumption to change SNI (Tim Perry) – High ( CVE-2026-123874 ) http2: retain streams during pending writes (Matteo Collina) – High ( CVE-2026-126051 ) tls: fix remotely reachable TLS server crash (Tim Perry) – High ( CVE-2026-123828 ) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium ( CVE-2026-123867 ) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium ( CVE-2026-123868 ) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium ( CVE-2026-123871 ) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium ( CVE-2026-123875 ) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium ( CVE-2026-123877 ) https: isolate Agent TLS policy keys (Matteo Collina) – Medium ( CVE-2026-123829 ) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low ( CVE-2026-123862 ) zlib: handle params callback after destroy (Matteo Collina) – Low (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low deps: update brotli to 1.2.1 (Node.js GitHub Bot) deps: update llhttp to 9.4.4 (Antoine du Hamel) deps: update sqlite to 3.54.1 (Node.js GitHub Bot) deps: update undici to 7.30.2 (Node.js GitHub Bot) Commits [ 4c12b8a775 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953 [ 5654932a7d ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931 [ e88009c61c ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003 [ 92e8d82e0e ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ 4164b5c2b4 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990 [ 4fec855b1d ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 [ 17c9eb75f3 ] - deps : update sqlite to 3.54.0 (Node.js GitHub Bot) #66663 [ 57ebbdc275 ] - deps : update undici to 7.30.2 (Node.js GitHub Bot) #67273 [ 8749030ae5 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 [ 8e100ac90a ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040 [ 03f040685b ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000 [ 7be19aa614 ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 [ ff8938913b ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 [ ae9ab37d62 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035 [ a081fd3a3e ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641 [ 22f4367981 ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252 [ 4f60230182 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 [ fdbc6ab7ac ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 [ d13a284de6 ] - src : fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986 [ c3485f2417 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018 [ 599ca08e28 ] - tls : disable resumption for mTLS wi
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.12.1
2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS This is a security release. Notable Changes ( CVE-2026-106069 , CVE-2026-106072 ) tls: reject non-canonical IP addresses (Matteo Collina) – High ( CVE-2026-105482 ) dns: validate resolve inputs for null bytes (James M Snell) – High ( CVE-2026-105483 ) tls: fix ip normalization regression (James M Snell) – High ( CVE-2026-111497 ) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High ( CVE-2026-111497 ) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High ( CVE-2026-105481 ) http: ensure agent data guard works without I/O (James M Snell) – Medium ( CVE-2026-106074 ) crypto: reset random caches across snapshots (Filip Skokan) – Medium ( CVE-2026-106070 ) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low ( CVE-2026-106071 ) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low ( CVE-2026-106073 ) permission: check permission model in realpathSync (RafaelGSS) – Low deps: V8: backport 93cd21e8254b (Joyee Cheung) crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) tls: reject chains containing blocked public keys (Ulises Gascon) deps: update c-ares to 1.34.9 (Node.js GitHub Bot) tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) crypto: harden X.509 conversion and formatting (Filip Skokan) Commits [ 818e4ca061 ] - crypto : update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877 [ fd3c87ed43 ] - crypto : harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966 [ acffa610db ] - crypto : reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987 [ 7895a5cd2d ] - deps : update undici to 8.12.2 (Node.js GitHub Bot) #66721 [ 12daa54d2e ] - deps : V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999 [ 6a8b3db7e2 ] - deps : update c-ares to 1.34.9 (Node.js GitHub Bot) #66868 [ a6040b50d9 ] - deps : brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002 [ 6b78ea171d ] - dns : validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984 [ 0683ee5f7d ] - http : ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983 [ e5cae10148 ] - Revert " module : synchronously load most ES modules" (Antoine du Hamel) #66786 [ cc244131aa ] - permission : check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973 [ 0392385841 ] - src : expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002 [ c273a408c9 ] - src : fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986 [ a2caddd20e ] - tls : reject chains containing blocked public keys (Ulises Gascon) #66871 [ ad788ccd07 ] - tls : reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982 [ cd4b05469c ] - tls : fix ip normalization regression (James M Snell) nodejs-private/node-private#985 [ 5fa440e0d7 ] - tools : retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855 [ 745ad77156 ] - zlib : avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.13.0
2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau Notable Changes This release marks the transition of Node.js 26.x into Long Term Support (LTS) with the codename 'Lithium'. It will continue to receive updates through to the end of April 2029. Other than updating metadata, such as the process.release object, to reflect that the release is LTS, no further changes from Node.js 26.12.1 are included. If you are updating from an earlier Long Term Support release (e.g. Node.js 24 or 22 or earlier) please note that since Node.js 25 the official binaries for Linux are linked against libatomic, which may need to be installed separately depending on your Linux distribution.
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.13.1
2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95 This is a security release. Notable Changes ( CVE-2026-123863 ) http2: release headers when a stream is removed (Matteo Collina) – High ( CVE-2026-123864 ) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High ( CVE-2026-123865 ) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High ( CVE-2026-123866 ) http2: retain buffers until socket writes finish (Matteo Collina) – High ( CVE-2026-123872 ) tls: disable resumption for mTLS with no session id context (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High ( CVE-2026-123872 ) tls: don't allow TLS resumption to change SNI (Tim Perry) – High ( CVE-2026-123874 ) http2: retain streams during pending writes (Matteo Collina) – High ( CVE-2026-126051 ) tls: fix remotely reachable TLS server crash (Tim Perry) – High ( CVE-2026-123828 ) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium ( CVE-2026-123867 ) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium ( CVE-2026-123868 ) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium ( CVE-2026-123871 ) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium ( CVE-2026-123875 ) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium ( CVE-2026-123877 ) https: isolate Agent TLS policy keys (Matteo Collina) – Medium ( CVE-2026-123829 ) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low ( CVE-2026-123862 ) zlib: handle params callback after destroy (Matteo Collina) – Low (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low deps: update brotli to 1.2.1 (Node.js GitHub Bot) deps: update llhttp to 9.4.4 (Antoine du Hamel) deps: update sqlite to 3.54.1 (Node.js GitHub Bot) deps: update undici to 8.12.4 (Node.js GitHub Bot) Commits [ 7b777661f5 ] - build : respect OpenSSL's configured API level (Filip Skokan) #66953 [ 4518c7501f ] - crypto : fix builds with older OpenSSL 3.0 (Filip Skokan) #66931 [ 94b73673b8 ] - deps : brotli: cherry-pick e230f474b87 (liujiahui) #61003 [ e315236158 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ 8e714f7daa ] - deps : update undici to 8.12.4 (Node.js GitHub Bot) #67272 [ af48b1a4d5 ] - deps : update brotli to 1.2.1 (Node.js GitHub Bot) #66990 [ 60316405bb ] - deps : update undici to 8.12.3 (Node.js GitHub Bot) #66993 [ 89b17baef4 ] - deps : update sqlite to 3.54.1 (Node.js GitHub Bot) #66816 [ d14db811c7 ] - http : redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001 [ 9183db64fe ] - http2 : retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040 [ 62ae278a23 ] - http2 : charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000 [ 7df134e2ce ] - http2 : retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017 [ 0ff0cf6749 ] - http2 : release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026 [ a84a01ddb8 ] - http2 : avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035 [ 3fc67dc056 ] - http2 : detect streams abandoned by nghttp2 (Matteo Collina) #66641 [ df4011dafe ] - http2 : guard against null write request on cancelled stream (Matteo Collina) #67252 [ fa61009dc1 ] - https : isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036 [ 40d3d8ddca ] - permission : do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967 [ 6c85b8e371 ] - tls : fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018 [ a8d6286949 ] - tls : disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030 [ e750e1fa02 ] - tls : don't allow renegotiation or
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-27.0.0-ALPHA.0.0.0
2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS Notable Changes V8 15.6 The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights: New language features enabled by default: Math.sumPrecise() , Intl.Locale.prototype.variants , Iterator.prototype.join() , Iterator.prototype.includes() , Iterator.zip() and Iterator.zipKeyed() . Experimental features behind flags: import defer ( --js-defer-import-eval ), Immutable ArrayBuffer ( --js-immutable-arraybuffer ) and RegExp buffer boundaries ( --js-regexp-buffer-boundaries ). Memory: when --max-old-space-size is not set, the default heap size limit is now half of the physical memory clamped between 256 MB and 4 GB, and memory held by Buffer and ArrayBuffer instances now counts toward the heap limit. Applications that relied on the previous defaults should set --max-old-space-size explicitly. Serialization: v8.serialize() , structuredClone() and postMessage() use a new format that older Node.js releases cannot read. v8.cachedDataVersionTag() and the compile cache also change on every Node.js patch of V8, not only on V8 version changes. Observable behavior changes: Math methods now use LLVM's libm and may differ in the last bit; Math.random() sequences change for a given --random-seed ; error.stack is no longer looked up through the prototype chain; await incurs fewer microtasks; Array.prototype.sort() uses PowerSort for large arrays and remains stable. Heap snapshots include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large. WebAssembly: asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name> . A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon. Contributed by Joyee Cheung in #65161 , #66537 and #66601 . Other notable changes [ 21cfb2a4ad ] - (SEMVER-MAJOR) build : remove the bundled FIPS provider build (Filip Skokan) #64777 [ 34e3b90621 ] - (SEMVER-MAJOR) build : require OpenSSL 3 or later (Filip Skokan) #64777 [ c362db6e24 ] - (SEMVER-MAJOR) build : downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 [ fb8d52d75a ] - (SEMVER-MAJOR) crypto : move DEP0093 to End-of-Life (Filip Skokan) #64777 [ 8be36fb494 ] - (SEMVER-MAJOR) crypto : remove legacy OpenSSL code paths (Filip Skokan) #64777 [ 718f044f07 ] - (SEMVER-MAJOR) crypto : validate digest output encodings (Filip Skokan) #66247 [ 6b8001d219 ] - (SEMVER-MAJOR) crypto : validate update input encodings (Filip Skokan) #66247 [ 127f79a911 ] - (SEMVER-MAJOR) crypto : validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 [ b116861e88 ] - (SEMVER-MAJOR) crypto : move DEP0198 to End-of-Life (Filip Skokan) #64000 [ 4d09c04253 ] - (SEMVER-MAJOR) crypto : move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 [ 9d50432837 ] - (SEMVER-MAJOR) crypto : reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 [ 63907e1018 ] - (SEMVER-MAJOR) crypto : throw on uninitialized DH computeSecret (Filip Skokan) #63922 [ 463e56fb00 ] - (SEMVER-MAJOR) crypto : runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 [ a2cd8aa883 ] - (SEMVER-MAJOR) crypto,https,tls : end OpenSSL engine support (Filip Skokan) #64777 [ 3983092f63 ] - (SEMVER-MAJOR) deps : update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 79239a48f1 ] - (SEMVER-MAJOR) deps : upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 85bfe9a938 ] - (SEMVER-MAJOR) deps : remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 [ 826df076a3 ] - (SEMVER-MAJOR) deps : update V8 to 15.6.75.13 (Joyee Cheung) #66601 [ 4eb3908d1f ] - (SEMVER-MAJOR) deps : upgrade npm to 12.1.0 (npm team) #66212 [ cba0833111 ] - (SEMVER-MAJOR) dgram : skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 [ 54a5095764 ] - (SEMVER-MAJOR) dns : do not consult hosts file in reverse lookups (Archkon) #64268 [ efc0a14461 ] - (SEMVER-MAJOR) dns : stop us
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-27.0.0-ALPHA.0.1.0
2026-11-12, Version 27.0.0-alpha.0.1.0 (Alpha), @aduh95 Notable Changes [ 33d4e6c73a ] - (SEMVER-MINOR) child_process : add subprocess.timedOut (Marco) #66639 [ edc7ec4a77 ] - (SEMVER-MINOR) crypto : make X.509 inspection guards explicit (Filip Skokan) #67245 [ 0882e9729b ] - (SEMVER-MINOR) crypto : add X.509 generation with CSR support (Filip Skokan) #67245 [ 2360d3860e ] - (SEMVER-MINOR) dns : coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599 [ dc4aa75983 ] - doc : add efekrskl to collaborators (Efe Karasakal) #67376 [ 9695304ab8 ] - doc : add Philipp Dunkel to contributors (Philipp Dunkel) #67378 [ 41db1f7b6b ] - doc : add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377 [ 6b8a90d41d ] - (SEMVER-MINOR) http : batch body spans per parser execute (Guilherme Araújo) #67187 [ 8ffcb3ee55 ] - (SEMVER-MINOR) sea : generate a compile cache for the VFS modules (Matteo Collina) #66768 [ 2bbcfa0718 ] - (SEMVER-MINOR) worker : preload streams into startup snapshot (Matteo Collina) #66311 Commits [ 81d2321054 ] - benchmark : add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837 [ 04b4552a77 ] - Revert " benchmark : add URLSearchParams iterator consumers benchmark" (Antoine du Hamel) #66837 [ 3ac0b42fb6 ] - benchmark : add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837 [ cdef4ac92b ] - benchmark : merge crc32c into crc32 zlib benchmark (Trivikram Kamat) #67004 [ faf48bfc07 ] - buffer : limit UTF-8 fast calls to safe one-byte strings (Robert Nagy) #67136 [ b7aab20d60 ] - build : separate host and target Rust artifacts in cross builds (Yuya Inoue) #66823 [ 829afea634 ] - build : refresh markdown lint dependencies on lockfile changes (Yuya Inoue) #67185 [ d9292c4a93 ] - build : sync Torque outputs with V8 (Filip Skokan) #67238 [ 9fca7e78bd ] - build : use a single producer for shared generated files (Yuya Inoue) #66804 [ 5848a08450 ] - build : sort the ICU source lists (Shelley Vohr) #67206 [ 0e1891a0e2 ] - build : set V8_DISABLE_PRESERVE_MOST (Joyee Cheung) #67093 [ 9c57966fb6 ] - build : error on incompatible dtls configure flags (Antoine du Hamel) #66947 [ 0487449970 ] - build : fix overriding node_path in GN build (David Babenko-Sanders) #66805 [ c617a93aa9 ] - build : remove unused FIPS export condition (Filip Skokan) #67005 [ 823549f0da ] - build,win : minify pgo training build (Stefan Stojanovic) #67214 [ 2f89ed5fde ] - child_process : inherit a reassigned process.env (Caleb Everett) #66883 [ 33d4e6c73a ] - (SEMVER-MINOR) child_process : add subprocess.timedOut (Marco) #66639 [ 42933d1749 ] - crypto : remove the FIPS provider name check (Filip Skokan) #67358 [ edc7ec4a77 ] - (SEMVER-MINOR) crypto : make X.509 inspection guards explicit (Filip Skokan) #67245 [ 0882e9729b ] - (SEMVER-MINOR) crypto : add X.509 generation with CSR support (Filip Skokan) #67245 [ d02681572b ] - crypto : fix ncrypto provider behavior (Brad Anderson) #67039 [ 0c4d131adf ] - crypto : prevent stale OpenSSL errors (Matteo Collina) #67225 [ 33d28a1fed ] - crypto : reuse HMAC contexts in createHmac() (Yagiz Nizipli) #67109 [ b9248dc829 ] - crypto : skip clearing empty OpenSSL error queues (Yagiz Nizipli) #67109 [ 216f1238cd ] - crypto : cache digests for synchronous operations (Yagiz Nizipli) #67109 [ 5991efaf17 ] - crypto : skip DH checks for recognized groups (Filip Skokan) #67071 [ 7b8589b5b0 ] - crypto : add X509Certificate inspection getters (Filip Skokan) #67082 [ ab5da00e5d ] - crypto : reject immutable random fill buffers (Filip Skokan) #66944 [ 1d297add9e ] - crypto : preserve errors during X.509 issuer checks (Filip Skokan) #66898 [ 5409ed48c9 ] - crypto,tls : clone X.509 chains across isolates (Filip Skokan) #66898 [ 988d73f171 ] - deps : update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038 [ cb3be3e9b5 ] - deps : update nghttp2 to 1.71.0 (Node.js GitHub Bot) #67331 [ 2539d1cb3f ] - deps : update ngtcp2 to 1.26.0 (Node.js GitHub Bot) #67257 [ 64cdd369d3 ] - deps : patch V8 to 15.6.75.50 (Node.js G
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 15 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.12.0
2026-10-14, Version 26.12.0 (Current), @richardlau Notable Changes [ 1ebd6d3677 ] - (SEMVER-MINOR) doc,lib,src : throw on missing WebAssembly or RX support (Paolo Insogna) #66533 [ 7f1937d2b9 ] - (SEMVER-MINOR) http : add websocketMask() and websocketUnmask() (James M Snell) #66335 Commits [ 30e76bb16a ] - benchmark : fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608 [ adef72223a ] - benchmark : fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604 [ 2f498f08fe ] - benchmark : add util.parseArgs benchmark (Rafael Gonzaga) #66599 [ 4ce8412e18 ] - benchmark : fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535 [ 493bd6c66e ] - benchmark,tools : fix napi benchmarks on GHA (Nigro Simone) #66423 [ e4515552d6 ] - build : run QUIC CI for V8 changes (Yuya Inoue) #66602 [ a888e51062 ] - build : support Python 3.15 (Mike McCready) #65750 [ 2afab9a63b ] - build : do not include shared gtest in node link path (Antoine du Hamel) #66626 [ f88c2f8ec6 ] - build,test : enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697 [ 5fd03e6fdf ] - child_process : propagate config-file permission flags to children (Rafael Gonzaga) #66559 [ f771134b07 ] - crypto : isolate provider EC PKCS8 encoding (Filip Skokan) #66413 [ 4e00a293db ] - crypto : remove key export and metadata locks (Filip Skokan) #66413 [ bcd8018775 ] - crypto : remove verify setup key locking (Filip Skokan) #66413 [ 883250fee2 ] - crypto : remove KEM key locking (Filip Skokan) #66413 [ 9d98805071 ] - crypto : remove RSA-OAEP key locking (Filip Skokan) #66413 [ d6293e7bb1 ] - crypto : skip secret key mutex allocation (Filip Skokan) #66413 [ 8d8af8003e ] - crypto : keep the root cert store per Environment (Shelley Vohr) #66411 [ c6f0614785 ] - crypto : remove select Web Crypto warnings (Filip Skokan) #66312 [ e5360b5a08 ] - deps : update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652 [ 7eb230a2c1 ] - deps : update acorn to 8.19.0 (Node.js GitHub Bot) #66655 [ af946ba8f3 ] - deps : update sqlite to 3.54.0 (Node.js GitHub Bot) #66663 [ 007872a85d ] - deps : V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627 [ f44aec4966 ] - deps : update simdjson to 5.0.3 (Daniel Lemire) #66620 [ 1a33e914e8 ] - deps : V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566 [ 3294d51e5a ] - diagnostics_channel : fix default callback context (Matteo Collina) #66481 [ 5c602a5824 ] - doc : list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649 [ eaeb4736c8 ] - doc : add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563 [ 0e1c99afae ] - doc : document stream/iter behaviors and Node.js extensions (James M Snell) #66483 [ 846236367d ] - doc : document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557 [ fc3b067be7 ] - doc : clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252 [ 73a4e90ce2 ] - doc : document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286 [ bb816582af ] - doc : fix request.reusedSocket timeout example (Efe Karasakal) #66286 [ 82223ab4d9 ] - doc : clarify revert PR label policy (Antoine du Hamel) #66529 [ c6f59d4e8e ] - doc : clarify node binary misuse after compromise (Rafael Gonzaga) #66530 [ 8904178498 ] - doc : document linux-x64-musl build toolchain (Issac) #66523 [ 1e8247a74e ] - doc : run license-builder (github-actions[bot]) #66517 [ b2773d5e4c ] - doc : add missing return types in cluster.md (Daniel Pinto) #66453 [ 1ebd6d3677 ] - (SEMVER-MINOR) doc,lib,src : throw on missing WebAssembly or RX support (Paolo Insogna) #66533 [ c1073f31de ] - ffi : fix exportArrayBuffer type check (Trivikram Kamat) #66455 [ 69148ee0ff ] - fs : lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483 [ 700c60a1cd ] - fs : serialize FileHandle writer() async writes (James M Snell) #66483 [ 32833def1c ] - http : reduce raw header name allocations (Roberto Bianchi) #66488 [ 7f1937d2b9 ] - (SEMVER-MINOR) http : add webso
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 12 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.22.0
2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95 Notable Changes [ ddbf974b47 ] - (SEMVER-MINOR) crypto : add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [ c162c68ff0 ] - (SEMVER-MINOR) crypto : add a generic MAC API (Filip Skokan) #65553 [ a4ab3d84d7 ] - (SEMVER-MINOR) crypto : discover ciphers from OpenSSL providers (Filip Skokan) #65484 [ c2f1e829ea ] - (SEMVER-MINOR) crypto : discover hashes from OpenSSL providers (Filip Skokan) #65484 [ 51aad5a80d ] - (SEMVER-MINOR) crypto : enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411 [ d11c65d2f2 ] - doc : add araujogui to collaborators (Guilherme Araújo) #66090 [ acc1578179 ] - doc : deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593 [ a7f8de6362 ] - (SEMVER-MINOR) net : support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725 [ 60c3eb61bd ] - (SEMVER-MINOR) perf_hooks : implement SlidingWindowHistogram (James M Snell) #65825 [ 6b3e6f9d5c ] - (SEMVER-MINOR) perf_hooks : implement qrde analysis support in Histogram (James M Snell) #65806 [ 75456a3512 ] - (SEMVER-MINOR) perf_hooks : implement Histogram meanCI API (James M Snell) #65606 [ 72d1b40c56 ] - (SEMVER-MINOR) perf_hooks : add CBOR export/import for histogram exchange (James M Snell) #65434 [ 41161dda87 ] - (SEMVER-MINOR) sqlite : add StatementSync.prototype.close() (Guilherme Araújo) #64232 [ adbc757d70 ] - (SEMVER-MINOR) sqlite : add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232 [ 241339f072 ] - (SEMVER-MINOR) src,lib : add util.markPromiseAsHandled (James M Snell) #65805 [ 63b0974d9e ] - (SEMVER-MINOR) util : implement util.throttle (James M Snell) #65899 [ a3bbb5a26f ] - (SEMVER-MINOR) util : implement debounce (James M Snell) #65899 Commits [ e6832b2cb1 ] - assert : fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449 [ a079177d9f ] - benchmark : add --csv option to compare.js with --analyze (James M Snell) #65922 [ 10b1a0f70f ] - benchmark : fix max-regressions detection in compare.js (James M Snell) #65587 [ e0c7ba8ad5 ] - benchmark : add --analyze option to benchmark/scatter.js (James M Snell) #65594 [ 21fed10bb0 ] - benchmark : add crypto class benchmarks (Filip Skokan) #65518 [ fa912242b7 ] - buffer : fix unaligned UTF-16LE decoding (Matteo Collina) #65905 [ a6bd0c1413 ] - build : suppress OpenSSL asm warnings with clang (Richard Lau) #66023 [ 94e12139ee ] - build : derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744 [ 7a2f322943 ] - build : fix quiet default for make builds (Shelley Vohr) #65826 [ c280d650b0 ] - build : allow linking shared dependencies in the GN build (Shelley Vohr) #65797 [ 4b23a4472c ] - build : enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237 [ 676e15c003 ] - build : define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464 [ f784058482 ] - build : remove obsolete configure flags (Chengzhong Wu) #65456 [ f63f37d243 ] - build : activate correct default flags for riscv64 (Stewart X Addison) #65708 [ da46ac075d ] - build : derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491 [ 249e9a16dd ] - build,src : gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #66082 [ 146f00f64b ] - child_process : clear timeout timer on spawn-time error too (kishore280) #65506 [ 13987f4418 ] - crypto : remove redundent std::move call (Antoine du Hamel) #66111 [ ef957ac85f ] - crypto : skip private RSA parameters in key details (Filip Skokan) #66108 [ 8feccc5e22 ] - crypto : use provider EC group names (Filip Skokan) #66108 [ 764e0d1120 ] - crypto : fetch ciphers for private-key encoding (Filip Skokan) #66108 [ 50ffed1979 ] - crypto : decode PKCS#1 keys through providers (Filip Skokan) #66108 [ 56c16b2fd6 ] - crypto : derive keys through EVP_KDF (Filip Skokan) #66108 [ a4effe6809 ] - crypto : use names for asymmetric key algorithms (Filip Skokan) #65966 [ ddbf974b47 ] - (SEMVER-MINOR) crypto : add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [ 8e631aa48f
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 11 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.11.0
2026-10-07, Version 26.11.0 (Current), @aduh95 Notable Changes [ 232f178825 ] - (SEMVER-MINOR) buffer : add isLatin1 (James M Snell) #66298 [ 27778036de ] - (SEMVER-MINOR) buffer : add Buffer.stringLength() (Matteo Collina) #66064 [ 4f84c4bda2 ] - build, doc : move to redesign (Aviv Keller) #62045 [ 6f6296fef9 ] - (SEMVER-MINOR) doc : promote Alpine Linux to tier 2 support (Stewart X Addison) #63737 [ e998d260d0 ] - (SEMVER-MINOR) http : add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334 [ 7702a50e08 ] - (SEMVER-MINOR) http2 : add connectionWindowSize option (Tim Perry) #65619 [ e06aa62cec ] - (SEMVER-MINOR) perf_hooks : fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115 [ ee126e37e8 ] - (SEMVER-MINOR) perf_hooks : allow RecordableHistogram to record 0 (James M Snell) #66114 [ 1fef8f54db ] - (SEMVER-MINOR) perf_hooks : add histogram.diff() (James M Snell) #66099 [ f1b9758c4e ] - (SEMVER-MINOR) perf_hooks : add histogram.snapshot() (James M Snell) #66099 [ 291d56ea3e ] - (SEMVER-MINOR) perf_hooks : harden histogram CBOR import validation (James M Snell) #66098 [ 6299b09d5c ] - (SEMVER-MINOR) process : graduate process.ref / unref to stable (James M Snell) #66213 [ 41d6707b63 ] - (SEMVER-MINOR) sqlite : rename DatabaseSync and StatementSync (Guilherme Araújo) #65988 [ 60d0aa0cd4 ] - (SEMVER-MINOR) src : add --process-timeout=N (James M Snell) #66138 [ f39916a7e3 ] - (SEMVER-MINOR) src : expose size and count in heap profile output (Ilyas Shabi) #65737 [ 0b00d5ea59 ] - (SEMVER-MINOR) src : let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067 Commits [ 11c3d7115d ] - benchmark : add implicit-framing case to http/set-header (Matteo Collina) #66420 [ 168b764fec ] - benchmark : add zstdCompress benchmark (James Ross) #66358 [ 69182564a7 ] - benchmark : add a node::MakeCallback benchmark (Nigro Simone) #66316 [ 12e540582f ] - (SEMVER-MINOR) benchmark : add http header validator benchmark (James M Snell) #66334 [ e6abdf6b01 ] - benchmark : remove duplicate ffi string length direct (Donghoon Kang) #66278 [ 480ca7cc55 ] - benchmark : fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257 [ c6bbc1b128 ] - benchmark : cover Web Crypto conversion costs (Filip Skokan) #66237 [ 85a2e4e270 ] - benchmark : remove duplicate ffi add-64 benchmark (Soul Lee) #66121 [ d0a72f2c12 ] - buffer : fix negative index for large buffers (Hilary Asogwa) #66325 [ b7f6a66a9f ] - (SEMVER-MINOR) buffer : add isLatin1 (James M Snell) #66298 [ 232f178825 ] - (SEMVER-MINOR) buffer : add isLatin1 (James M Snell) #66298 [ f7d3d11c11 ] - buffer : fix odd UTF-16LE indexOf start (Yuya Inoue) #65960 [ 27778036de ] - (SEMVER-MINOR) buffer : add Buffer.stringLength() (Matteo Collina) #66064 [ 9f1db461d2 ] - build : update common.gypi for z/OS (Gaby Baghdadi) #66449 [ 0002037b3f ] - build : update configure.py for z/OS (Gaby Baghdadi) #66449 [ a341ac460a ] - build : fix vcbuild format-md install and exit (Ved Chaudhari) #66475 [ bec52d9103 ] - build : fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467 [ 9acdb5910c ] - build : toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293 [ 6ee32f857a ] - build : support LIEF 0.17.x and 1.x (Yuya Inoue) #66240 [ 2248869955 ] - build : add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136 [ 49069529eb ] - build : add GZIP_COMPRESSION Make variable (inoway46) #66228 [ 9066d33aa2 ] - build : port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183 [ 1f4a8fb1cb ] - build : add v8_enable_temporal_systemicu (Steven R. Loomis) #65992 [ 4f84c4bda2 ] - build, doc : move to redesign (Aviv Keller) #62045 [ a0e7141ffc ] - child_process : build the default env block in one native pass (Shelley Vohr) #65325 [ 9fa31096d4 ] - crypto : improve random synchronous number generation performance (Mert Can Altin) #66348 [ 53cde9d1f8 ] - crypto : fix raw key export error for wrong key type (한국) #66217 [ 32ba6d5ada ] - crypto : use backend cSHAKE and KMAC (Filip Sk
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 11 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.11.1
2026-10-07, Version 26.11.1 (Current), @aduh95 Commits [ 2dc4638e85 ] - Revert " build : toggle doc-kit verbosity based on V" (Antoine du Hamel) [ 3febbc54ec ] - Revert " build, doc : move to redesign" (Antoine du Hamel) [ 173250e2e7 ] - Revert " tools : bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 11 Nov 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-22.23.3
2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbol Notable Changes [ fe2a6b2be8 ] - crypto : update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [ 871167ddfd ] - deps : update corepack to 0.36.0 (Node.js GitHub Bot) #65653 [ b816fc8958 ] - deps : upgrade npm to 10.9.9 (npm team) #64884 [ e306521444 ] - deps : update icu to 78.3 (Node.js GitHub Bot) #62324 [ a9cb31129f ] - deps : update OpenSSL 3.5.8 (Node.js GitHub Bot) #65542 [ 2a3548e51c ] - deps : update Undici to 6.28.1 (mcollina) #65790 [ 3909ff2c4a ] - node-api : support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710 [ 66de6349ad ] - node-api : add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623 Commits [ 44cf27b8fa ] - build : update binary-upload to use correct tarball name (Stewart X Addison) #65282 [ fe2a6b2be8 ] - crypto : update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [ 71feba6b69 ] - crypto : update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 [ 871167ddfd ] - deps : update corepack to 0.36.0 (Node.js GitHub Bot) #65653 [ 2a3548e51c ] - deps : update undici to 6.28.1 (mcollina) #65790 [ 59d853a4df ] - deps : update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542 [ a9cb31129f ] - deps : upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542 [ 3376e27de2 ] - deps : V8: cherry-pick a6eaf7574109 (Camillo Bruni) #65402 [ b816fc8958 ] - deps : upgrade npm to 10.9.9 (npm team) #64884 [ 4e4bd1b104 ] - deps : update timezone to 2026c (Node.js GitHub Bot) #64588 [ 7d82841b4e ] - deps : update c-ares to 1.34.8 (Node.js GitHub Bot) #64330 [ 01855a19d3 ] - deps : c-ares: cherry-pick 8ba37af8e3fb (René) #64110 [ 23fb398c3d ] - deps : update corepack to 0.35.0 (Node.js GitHub Bot) #63375 [ 5286330365 ] - deps : update corepack to 0.34.7 (Node.js GitHub Bot) #62810 [ 6d6c3c98b1 ] - deps : update timezone to 2026b (Node.js GitHub Bot) #62962 [ e306521444 ] - deps : update icu to 78.3 (Node.js GitHub Bot) #62324 [ d9cb8468a3 ] - doc : clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515 [ c9c5662d91 ] - doc : add sxa GPG key (ed25519) (Stewart X Addison) #64193 [ 37f21068c4 ] - fs : restore fs patchability in ESM loader (Joyee Cheung) #62835 [ 7c2df5dd96 ] - http2 : avoid uaf while receiving and sending rst_stream (esgor) #64166 [ 3909ff2c4a ] - node-api : support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710 [ 66de6349ad ] - node-api : add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623 [ ce9139107f ] - src : escape Windows environment variables in task runner (Antoine du Hamel) #65217 [ 839480a471 ] - test : fix link-local dgram scope assertion (Filip Skokan) #65629 [ 40eac4a32f ] - test : account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542 [ 75098a9e8c ] - tools : update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065 [ 08b6ac0416 ] - tools : revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627 [ 02cafc479f ] - tools : fix commit linter for semver-major release proposals (Antoine du Hamel) #62993 [ 6f6cd3768d ] - tools : sync mk-ca-bundle.pl with curl (Archkon) #64753 [ bc5753d438 ] - tools : remove envinfo from our workflows (Antoine du Hamel) #64259 [ d68ee9f8a5 ] - tools : validate version number in release proposal commit message lint (Antoine du Hamel) #64070 [ 38ee2e895f ] - tools : avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938 [ fdc65e489f ] - tools : use different branch for tool updates on staging branches (Antoine du Hamel) #63110 [ e5a6fde002 ] - tools : update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961 [ 5fbbad6e82 ] - url : handle unparsable serialized URLs in setters (Matteo Collina) #64651 [ ed019e4854 ] - util : preserve function names without source map names (Hiroki Osame) #65108
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 29 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.10.0
2026-09-22, Version 26.10.0 (Current), @aduh95 Notable Changes [ c0a42d23e5 ] - (SEMVER-MINOR) crypto : add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [ eb4fabe81e ] - doc : add araujogui to collaborators (Guilherme Araújo) #66090 [ 64fb33d791 ] - (SEMVER-MINOR) ffi : load libraries from a mounted VFS (Matteo Collina) #65909 [ 2b1701f810 ] - (SEMVER-MINOR) fs : add openAsBlobSync (greenhead) #65644 [ 080e76b3d7 ] - (SEMVER-MINOR) net : support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725 [ 13e61f6ae6 ] - (SEMVER-MINOR) perf_hooks : implement SlidingWindowHistogram (James M Snell) #65825 [ a326546094 ] - (SEMVER-MINOR) perf_hooks : implement qrde analysis support in Histogram (James M Snell) #65806 [ 0306b0a71e ] - (SEMVER-MINOR) sqlite : bind undefined to NULL (Trevor Burnham) #65709 [ 3c999edef7 ] - (SEMVER-MINOR) src,lib : add util.markPromiseAsHandled (James M Snell) #65805 [ f7d18ec360 ] - (SEMVER-MINOR) test : expand histogram test coverage (James M Snell) #65825 [ 3ce4d23bbb ] - (SEMVER-MINOR) util : implement util.throttle (James M Snell) #65899 [ 336f33ccc1 ] - (SEMVER-MINOR) util : implement debounce (James M Snell) #65899 Commits [ 2bf082453b ] - assert : fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449 [ c518831d00 ] - benchmark : add --csv option to compare.js with --analyze (James M Snell) #65922 [ 89bae46e68 ] - buffer : fix unaligned UTF-16LE decoding (Matteo Collina) #65905 [ 01cee9dcef ] - build : do not use bundled simdutf when built with --shared-simdutf (Antoine du Hamel) #65891 [ 20606a4d19 ] - build : suppress OpenSSL asm warnings with clang (Richard Lau) #66023 [ a76e97b5c5 ] - build : derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744 [ ac7fcf0cef ] - build : sync cargo/rustc version warnings (Richard Lau) #65912 [ f24a495b36 ] - build : fix quiet default for make builds (Shelley Vohr) #65826 [ c4381765fe ] - child_process : clear timeout timer on spawn-time error too (kishore280) #65506 [ 8955781eeb ] - crypto : remove redundent std::move call (Antoine du Hamel) #66111 [ 0b88aa5a15 ] - crypto : read RSA-PSS restrictions from provider (Filip Skokan) #66108 [ f90d3d3cb0 ] - crypto : skip private RSA parameters in key details (Filip Skokan) #66108 [ 97828d91db ] - crypto : use provider EC group names (Filip Skokan) #66108 [ 3de05da569 ] - crypto : fetch ciphers for private-key encoding (Filip Skokan) #66108 [ ca8ee04594 ] - crypto : decode PKCS#1 keys through providers (Filip Skokan) #66108 [ 54a625e953 ] - crypto : derive keys through EVP_KDF (Filip Skokan) #66108 [ 971adece6a ] - crypto : use names for asymmetric key algorithms (Filip Skokan) #65966 [ bfb544eb00 ] - crypto : optimize and benchmark key preparation (Filip Skokan) #65892 [ c0a42d23e5 ] - (SEMVER-MINOR) crypto : add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [ c58a4e0ba7 ] - crypto : add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759 [ 70edf90851 ] - crypto : avoid EC reconstruction for signature sizing (Filip Skokan) #65908 [ fab5dddd77 ] - crypto : avoid EC raw export reconstruction (Filip Skokan) #65908 [ 220a499614 ] - crypto : export EC JWK coordinates directly (Filip Skokan) #65908 [ f1295e11db ] - crypto : read EC curve metadata directly (Filip Skokan) #65908 [ 775173a5db ] - crypto : optimize private EC JWK import (Filip Skokan) #65908 [ e44669bb7d ] - crypto : validate the limit of PBKDF2 iterations (Filip Skokan) #65704 [ cd5a7611e9 ] - crypto : use primordials in HKDF info validation (Filip Skokan) #65704 [ 94affce749 ] - Revert " deps : V8: override depot_tools version" (Richard Lau) #66110 [ 870a366c49 ] - deps : V8: cherry-pick 95efbaf92a0d (Igor Sheludko) #66020 [ d62a452738 ] - deps : V8: backport a0607c5006b8 (Antoine du Hamel) #65891 [ e8edeffe2d ] - deps : update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) #66009 [ eb4fabe81e ] - doc : add araujogui to collaborators (Guilherme Araújo) #66090 [ 2fffb3872d ] - doc : fix duplicate 't
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 28 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.9.0
2026-09-16, Version 26.9.0 (Current), @aduh95 Notable Changes [ d414624dce ] - (SEMVER-MINOR) crypto : add a generic MAC API (Filip Skokan) #65553 [ 7ac458f802 ] - (SEMVER-MINOR) crypto : discover ciphers from OpenSSL providers (Filip Skokan) #65484 [ 7c7e95a3bd ] - (SEMVER-MINOR) crypto : discover hashes from OpenSSL providers (Filip Skokan) #65484 [ 2d2f4f6d1a ] - (SEMVER-MINOR) ffi : enable module by default (Matteo Collina) #65475 [ 657415c6df ] - (SEMVER-MINOR) lib : implement node:bench (James M Snell) #65606 [ ebcfec2f0c ] - (SEMVER-MINOR) perf_hooks : implement Histogram meanCI API (James M Snell) #65606 [ e1913630c3 ] - (SEMVER-MINOR) perf_hooks : add CBOR export/import for histogram exchange (James M Snell) #65434 [ 8e9151c9f2 ] - (SEMVER-MINOR) src : let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352 [ 889854f18b ] - (SEMVER-MINOR) src,lib : implement experimental DTLS API (James M Snell) #63182 [ 5198142c59 ] - (SEMVER-MINOR) vfs : integrate with CJS and ESM module loaders (Matteo Collina) #63653 [ 5af9d72e7f ] - (SEMVER-MINOR) worker : add support for Web Workers (Aviv Keller) #64894 Commits [ 59dcad3f44 ] - (SEMVER-MINOR) benchmark : implement node:bench version of bench tools (James M Snell) #65606 [ 6bdb6dd8fa ] - benchmark : fix max-regressions detection in compare.js (James M Snell) #65587 [ 49d40091ba ] - benchmark : add --analyze option to benchmark/scatter.js (James M Snell) #65594 [ bd40a9a19a ] - benchmark : add crypto class benchmarks (Filip Skokan) #65518 [ 6bff2238f5 ] - buffer : pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #65605 [ 37d12946dd ] - buffer : prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #65430 [ 02f8eb3b2d ] - build : add --shared-perfetto flag (Antoine du Hamel) #65614 [ fe7032ec41 ] - build : enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786 [ 109f2caf80 ] - build : allow linking shared dependencies in the GN build (Shelley Vohr) #65797 [ 55213fd8a8 ] - build : enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237 [ 120929a1b3 ] - build : add --shared-highway configure flag (Antoine du Hamel) #65686 [ c99af0942b ] - build : add --shared-abseil configure flag (Antoine du Hamel) #65682 [ 431c2bf0eb ] - build : define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464 [ b6b5764c6e ] - build : remove obsolete configure flags (Chengzhong Wu) #65456 [ a623ee29d9 ] - build,src : make --use-largepages a no-op (Joyee Cheung) #65389 [ 2f494cb7aa ] - crypto : fix multi-prime RSA JWKs (Filip Skokan) #65649 [ 501d8ac815 ] - crypto : cache valid ECDH key pairs (Filip Skokan) #65615 [ 3fd905ea8f ] - crypto : add strict mode to --force-fips (Filip Skokan) #65645 [ 54b3cdb805 ] - crypto : add FIPS indicator diagnostics channel (Filip Skokan) #65645 [ 3e6e931fc9 ] - crypto : fix public PKCS8 export error (한국) #65609 [ d414624dce ] - (SEMVER-MINOR) crypto : add a generic MAC API (Filip Skokan) #65553 [ eef579047c ] - crypto : validate JWK usages before key_ops (Filip Skokan) #65550 [ 9a9b137a24 ] - crypto : fix private SPKI export error (Filip Skokan) #65550 [ 9941fb5dab ] - crypto : fix RSA-PSS oversized salt handling (Filip Skokan) #65550 [ 09b431596a ] - crypto : correct CCM decryption FIPS error message (kyungrae) #65450 [ e6b34e6f7a ] - crypto : harden X509Certificate state (Filip Skokan) #65518 [ a884b6ccbc ] - crypto : optimize key slot caching (Filip Skokan) #65518 [ fb512086d3 ] - crypto : add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457 [ 656504ffc0 ] - crypto : prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112 [ 15e7884732 ] - crypto : avoid throwing CryptoKey brand checks (Filip Skokan) #65503 [ 3302bec74a ] - crypto : avoid throwing KeyObject brand checks (Filip Skokan) #65503 [ 7ac458f802 ] - (SEMVER-MINOR) crypto : discover ciphers from OpenSSL providers (Filip Skokan) #65484 [ 7c7e95a3bd ] - (SEMVER-MINOR) crypto : discover hashes from OpenSSL providers (Filip Skokan) #65484 [ 0
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 28 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.21.0
2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95 Notable Changes [ 71106e1f17 ] - crypto : update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [ afca0a912d ] - (SEMVER-MINOR) crypto : support loading private keys through STORE loaders (Filip Skokan) #63949 [ 6274fccbd9 ] - deps : update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542 [ 53cba013c7 ] - deps : update Undici to 7.29.1 (Node.js GitHub Bot) #65789 [ 0529772798 ] - (SEMVER-MINOR) lib,src : improve histogram implementation (James M Snell) #65024 [ 41c7062b81 ] - (SEMVER-MINOR) net : improve performance of net.BlockList (James M Snell) #64974 [ 5197b5a3c5 ] - (SEMVER-MINOR) perf_hooks : add statistical hypothesis testing to histogram (James M Snell) #65416 [ 35c635b032 ] - (SEMVER-MINOR) util : add non-throwing MIMEType.parse (James M Snell) #64965 Commits [ 84d706cb9b ] - assert : improve documentation wording (Kamal Rawal) #64953 [ 90d127db33 ] - (SEMVER-MINOR) benchmark : add --analyze mode to compare.js (James M Snell) #65416 [ ad1d7884c3 ] - benchmark : add test-only and mock timers cases (Luan Muniz) #64097 [ 1d8f045914 ] - benchmark : apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138 [ ed7ba3c993 ] - benchmark : complete the sqlite is-transaction fix (Edy Silva) #65218 [ c8837e1aa3 ] - benchmark : add test runner hooks and options (Luan Muniz) #63754 [ 2ba8661e23 ] - buffer : prevent string write offset overflow (Matteo Collina) #65043 [ cc9ee6c2ae ] - buffer : treat detached ArrayBuffers as empty (Archkon) #64504 [ 5a5d73e4c5 ] - build : pass target architecture to small-icu genccode (ulofiai) #65095 [ 273e72d1a5 ] - build : deprecate always enabled --enable-static (Chengzhong Wu) #65103 [ 89a67246e3 ] - build : check FIPS option value in node.gyp (Filip Skokan) #64982 [ 2d21f41cd5 ] - build : handle malformed OpenSSL macros (Filip Skokan) #64982 [ f62bc0f862 ] - build,win : add PGO workload scripts (Stefan Stojanovic) #63696 [ 33d0c7dc12 ] - child_process : keep SIGWINCH from killing on Win (Kirill Saied) #64510 [ 71106e1f17 ] - crypto : update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [ 419af8b86d ] - crypto : fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200 [ 8029383f3f ] - crypto : use available BoringSSL APIs (Filip Skokan) #65423 [ a9bd780e19 ] - crypto : remove obsolete BoringSSL shims (Filip Skokan) #65423 [ 7defefad3f ] - crypto : read WebCrypto inputs through primordials (Filip Skokan) #65115 [ 6ed1e38627 ] - crypto : fix disabling FIPS mode (Filip Skokan) #64982 [ afca0a912d ] - (SEMVER-MINOR) crypto : support loading private keys through STORE loaders (Filip Skokan) #63949 [ 9b9dd6e9cf ] - debugger : wait for target startup (Filip Skokan) #65194 [ 07faaeeffd ] - deps : update corepack to 0.36.0 (Node.js GitHub Bot) #65653 [ 53cba013c7 ] - deps : update undici to 7.29.1 (Node.js GitHub Bot) #65789 [ 0268ca547c ] - deps : update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542 [ 6274fccbd9 ] - deps : upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542 [ 6bdcd121fa ] - deps : update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316 [ c2aa446b6d ] - deps : update simdjson to 4.6.7 (Node.js GitHub Bot) #65318 [ 3e58e48ea8 ] - deps : update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317 [ 670b3665c0 ] - deps : cherry-pick libuv/libuv@ e640dc9 (ulofiai) #65118 [ ca1c67b021 ] - deps : float ICU-23262 patch for icu78 (René) #64678 [ 4ad043b0aa ] - deps : enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #65136 [ 96b4af109b ] - deps : update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) #65153 [ 774f663c56 ] - dgram : don't swallow bind errors when callback is provided (armanmikoyan) #62602 [ 94b118d62e ] - diagnostics_channel : validate before channel activation (Trivikram Kamat) #65313 [ 09788665bd ] - dns : validate address type in lookupService (Lazizbek Ergashev) #64878 [ 15f95fc0e2 ] - dns : validate port range in setServers() (René
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 21 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.8.1
2026-08-26, Version 26.8.1 (Current), @aduh95 Notable Changes Out-of-band release to fix node --version which was reporting an alpha version. Commits [ ebd35a9eec ] - src : revert accidental alpha designation (Antoine du Hamel) #65568 [ 0b0dd87fcc ] - tools : fix tools/nix/list-requisites.sh (Antoine du Hamel) #65560
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 21 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.8.2
2026-09-09, Version 26.8.2 (Current), @aduh95 Notable Changes [ 616bd3fa26 ] - doc : deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593 [ ae1801eb55 ] - meta : refine the security vuln posture for experimental features (James M Snell) #65438 [ 09feba74c8 ] - deps : update Undici to 8.10.2 (Node.js GitHub Bot) #65788 [ 7efdbe3eb9 ] - deps : update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542 Commits [ d8aedd6584 ] - build : skip dockit on riscv64 (Stewart X Addison) #62251 [ 1899c274eb ] - build : activate correct default flags for riscv64 (Stewart X Addison) #65708 [ ec8a3be996 ] - build : derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491 [ b73118a507 ] - build,win : remove LTO parallelisation limit (Stefan Stojanovic) #65535 [ 09feba74c8 ] - deps : update undici to 8.10.2 (Node.js GitHub Bot) #65788 [ e47c432dd6 ] - deps : upgrade npm to 11.19.1 (npm team) #65573 [ 2fd6ce36a9 ] - deps : update corepack to 0.36.0 (Node.js GitHub Bot) #65653 [ 49dec2767a ] - deps : update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654 [ 676174a071 ] - deps : update simdjson to 4.6.9 (Node.js GitHub Bot) #65655 [ 2f1b7fa0bb ] - deps : update perfetto to 58.2 (Node.js GitHub Bot) #65656 [ 12acd0ad15 ] - deps : update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494 [ 48631c80fb ] - deps : update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542 [ 7efdbe3eb9 ] - deps : upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542 [ bdc75900ee ] - doc : replace node:modules documentation header (René) #65800 [ 44c8a499ba ] - doc : clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743 [ 025fb5eeb0 ] - doc : update changelog-maker instructions for releasing (Juan José) #65707 [ 5f64847afa ] - doc : add stability status to crypto.setEngine (Antoine du Hamel) #65746 [ 299dee0cb9 ] - doc : remove outdated TLS authorized warning (Tim Perry) #65597 [ e97dcc0278 ] - doc : fix broken using link in ffi.md (Soul Lee) #65632 [ 2c9cc7d237 ] - doc : fix some broken links (Antoine du Hamel) #65583 [ 0c330ec329 ] - doc : fix stale TOC in maintaining-dependencies (greenhead) #65523 [ 9c522a3a69 ] - doc : refactor the AI guidelines (Joyee Cheung) #65269 [ 46cbf1bf8c ] - doc : fix triggerAsyncId() comment in async_hooks example (soreavis) #64583 [ 788904ff78 ] - doc : fix fsPromises.watch overflow value (Matt Radbourne) #64605 [ 3d06ff19e8 ] - doc : clarify stream direction in options.stdio note (Avocado) #65236 [ d334838379 ] - doc : clarify signal listener behavior (Som Samantray) #65243 [ d55a2bd56a ] - doc : add test reporter event lifecycle diagram (sangwook) #63780 [ c17dfc87de ] - doc : discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342 [ 616bd3fa26 ] - doc : deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593 [ 4e6d7e0ca6 ] - meta : cleanup targos emeritus changes (Antoine du Hamel) #65738 [ a70cfe1747 ] - meta : bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714 [ e43a0ad4ce ] - meta : bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717 [ 99e06288f1 ] - meta : bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718 [ 89662762b3 ] - meta : bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719 [ 6b8f078672 ] - meta : bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720 [ 6c6fb18e63 ] - meta : bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721 [ 0e002e859f ] - meta : bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722 [ 98aaffe4b9 ] - meta : bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723 [ d247cb2975 ] - meta : document collaborator automation (Filip Skokan) #65671 [ ae1801eb55 ] - meta : refine the security vuln posture for experimental features (James M Snell) #65438 [ fab81d15c3 ] - test : widen the gap in the resolver maxTimeout comparison
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 21 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-24.20.0
2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95 Notable Changes [ b12bcc9ae1 ] - (SEMVER-MINOR) async_hooks : add using scopes to AsyncLocalStorage (Stephen Belanger) #61674 [ e2eb88b36b ] - (SEMVER-MINOR) buffer : add end parameter (Robert Nagy) #62390 [ 1fefdda18e ] - crypto : update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [ 4a158cf1ab ] - doc : add MikeMcC399 as collaborator (Mike McCready) #64656 [ d4cafce076 ] - (SEMVER-MINOR) lib,permission : add permission.drop (Rafael Gonzaga) #62672 [ b3cfb55267 ] - (SEMVER-MINOR) loader : implement package maps (Maël Nison) #62239 [ cd1eb3e60b ] - (SEMVER-MINOR) src,permission : add --permission-audit (RafaelGSS) #61869 [ 28dc85d8d2 ] - (SEMVER-MINOR) stream : add node:stream/iter implementation (James M Snell) #62066 [ d31c168740 ] - (SEMVER-MINOR) test_runner : add context.log() and test:log event (Moshe Atlow) #64389 [ add1edbc42 ] - (SEMVER-MINOR) test_runner : report entryFile in TestStream events (Moshe Atlow) #64309 [ d937c8c6cd ] - (SEMVER-MINOR) wasm : enable JSPI (Guy Bedford) #59941 Commits [ 1822c0f335 ] - assert,util : fix TypeError on Maps with null keys (Paul Bouchon) #64441 [ b12bcc9ae1 ] - (SEMVER-MINOR) async_hooks : add using scopes to AsyncLocalStorage (Stephen Belanger) #61674 [ 984260bf44 ] - async_hooks : use validateBoolean for trackPromises (Soul Lee) #64731 [ ba2612cca2 ] - benchmark : fix calibrate-n option handling (Luan Muniz) #64146 [ 236dc4d2d7 ] - benchmark : add bytes variant to webstreams async-iterator (Matteo Collina) #64291 [ b022a1419c ] - benchmark : respect stream/iter broadcast backpressure (Trivikram Kamat) #63314 [ a290f51f15 ] - (SEMVER-MINOR) benchmark : add benchmarks for experimental stream/iter (James M Snell) #62066 [ 465f2bfb74 ] - buffer : use Clamp conversion in Blob slice (Donghoon Kang) #64739 [ 74a22cd0c5 ] - buffer : validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904 [ 21e24208dc ] - buffer : normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115 [ ddacb3ff10 ] - buffer : fix Blob.stream() leaking source buffer (semimikoh) #63577 [ 49198d2313 ] - buffer : fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711 [ e2eb88b36b ] - (SEMVER-MINOR) buffer : add end parameter (Robert Nagy) #62390 [ e2e5c4fe88 ] - build : update binary-upload to use correct tarball name (Stewart X Addison) #65282 [ b78a212553 ] - build : pin envinfo versions in github actions (Joyee Cheung) #64117 [ 094fb840aa ] - build : add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875 [ 91f5003cad ] - build : fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #60073 [ e83648effd ] - build,test : add tests for binary linked with shared libnode (Joyee Cheung) #61463 [ 4a425b41d9 ] - build,tools : fix shared library cross-compile (Kirill Saied) #63963 [ fe8fa45ff2 ] - cli : style node --help output with util.styleText (Adrián Estrada) #64484 [ 3cd1576cb2 ] - crypto : preserve OpenSSL errors from KDF failures (Filip Skokan) #64776 [ 74b3023565 ] - crypto : handle XOF output allocation failure (Filip Skokan) #64851 [ fea0666a1b ] - crypto : clarify missing cipher error (Filip Skokan) #64852 [ 33fec91b54 ] - crypto : reuse X509 issuer result (Filip Skokan) #64852 [ 44c1473348 ] - crypto : validate key generation options (Filip Skokan) #64852 [ c2c53a18e5 ] - crypto : fix Argon2 validation errors (Filip Skokan) #64852 [ edc1f2126d ] - crypto : initialize KeyObjectData mutex eagerly (Filip Skokan) #64851 [ be8237240c ] - crypto : handle DH operation failures (Filip Skokan) #64851 [ b65a8f3875 ] - crypto : preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547 [ 49f2ae204b ] - crypto : cleanse provider private key copies (Filip Skokan) #64547 [ a5d4ac8208 ] - crypto : handle incomplete RSA private keys (Filip Skokan) #64547 [ b72c0b9616 ] - crypto : retain legacy DH validation (Filip Skokan) #64547 [ 24a1be5886 ] - crypto : limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557 [ 0290e0a61e ] - crypto : sp
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 14 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.8.0
2026-08-26, Version 26.8.0 (Current), @aduh95 Notable Changes [ 74234ee30e ] - (SEMVER-MINOR) benchmark : add --analyze mode to compare.js (James M Snell) #65416 [ 4232997fa2 ] - crypto : update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [ f0531f1c87 ] - (SEMVER-MINOR) crypto : enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411 [ 3f4b80ebb5 ] - diagnostics_channel : mark TracingChannel as stable (Abdelrahman Awad) #64525 [ 753033c110 ] - (SEMVER-MINOR) lib,src : improve histogram implementation (James M Snell) #65024 [ 3d7d277493 ] - (SEMVER-MINOR) net : improve performance of net.BlockList (James M Snell) #64974 [ 9e8e9080fd ] - (SEMVER-MINOR) perf_hooks : add statistical hypothesis testing to histogram (James M Snell) #65416 [ c18b0aa54e ] - repl : add basic syntax highlighting (Aviv Keller) #64591 [ 58ea88e1d3 ] - (SEMVER-MINOR) sqlite : add StatementSync.prototype.close() (Guilherme Araújo) #64232 [ 7c61b08aed ] - (SEMVER-MINOR) sqlite : add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232 [ 4299cd5897 ] - (SEMVER-MINOR) util : add non-throwing MIMEType.parse (James M Snell) #64965 [ df48191061 ] - (SEMVER-MINOR) zlib : add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339 Commits [ 162257b403 ] - assert : improve documentation wording (Kamal Rawal) #64953 [ 74234ee30e ] - (SEMVER-MINOR) benchmark : add --analyze mode to compare.js (James M Snell) #65416 [ 2cb96dd462 ] - benchmark : add test-only and mock timers cases (Luan Muniz) #64097 [ 562168f93f ] - benchmark : apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138 [ fbec4eb386 ] - benchmark : complete the sqlite is-transaction fix (Edy Silva) #65218 [ d8acfc45f1 ] - benchmark : add test runner hooks and options (Luan Muniz) #63754 [ 13e7d54f67 ] - buffer : prevent string write offset overflow (Matteo Collina) #65043 [ 615273deac ] - buffer : support aligned allocations (Robert Nagy) #65003 [ bc6b630e21 ] - buffer : treat detached ArrayBuffers as empty (Archkon) #64504 [ ddf9f9d265 ] - build : target Power 9 and z14 (Richard Lau) #65439 [ fda8ee894e ] - build : use build-ci for benchmark merge-commit rebuild (Yagiz Nizipli) #65362 [ 03692786ef ] - build : add simdutf dir to include path in GN build (Shelley Vohr) #65382 [ 3da555a3ed ] - build : pass target architecture to small-icu genccode (ulofiai) #65095 [ ffe1e7cbea ] - build : update binary-upload to use correct tarball name (Stewart X Addison) #65282 [ 50174cb94a ] - build : deprecate always enabled --enable-static (Chengzhong Wu) #65103 [ 28f662b424 ] - build : check FIPS option value in node.gyp (Filip Skokan) #64982 [ 29a2ecefeb ] - build : handle malformed OpenSSL macros (Filip Skokan) #64982 [ 6deeef1801 ] - build : enable perfetto updater (Chengzhong Wu) #64966 [ 312f0c6a7e ] - build : add host toolset to perfetto_sdk (Ryuhei Shima) #64751 [ 1a4f5e537b ] - build,win : add PGO workload scripts (Stefan Stojanovic) #63696 [ 21655dccbc ] - child_process : keep SIGWINCH from killing on Win (Kirill Saied) #64510 [ 4232997fa2 ] - crypto : update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [ f0531f1c87 ] - (SEMVER-MINOR) crypto : enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411 [ 109566a2f7 ] - crypto : fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200 [ 501f81612d ] - crypto : improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222 [ 137ff67fd3 ] - crypto : use available BoringSSL APIs (Filip Skokan) #65423 [ 0e87576ed4 ] - crypto : remove obsolete BoringSSL shims (Filip Skokan) #65423 [ af867ce3e4 ] - crypto : add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073 [ 66ee4792bf ] - crypto : disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172 [ 6a142c03e9 ] - crypto : read WebCrypto inputs through primordials (Filip Skokan) #65115 [ 92e3110462 ] - crypto : fix disabling FIPS mode (Filip Skokan) #64982 [ d69bed2f49 ] - debugger : wait for target startup (Filip Skokan) #65194 [ 5c7c0b8b15 ] - deps : update z
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 14 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.7.0
2026-08-05, Version 26.7.0 (Current), @aduh95 Notable Changes [ 58717685a1 ] - (SEMVER-MINOR) crypto : support loading private keys through STORE loaders (Filip Skokan) #63949 [ 44b940ee8c ] - crypto : update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [ c1e4f7365e ] - (SEMVER-MINOR) lib : add perfetto support (Chengzhong Wu) #64565 [ 11c2f9c642 ] - (SEMVER-MINOR) module : implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928 [ a646319f61 ] - (SEMVER-MINOR) test_runner : add support for --test-coverage-include-all (avivkeller) #64830 Commits [ a2d3f891d3 ] - async_hooks : use validateBoolean for trackPromises (Soul Lee) #64731 [ d7266cdd99 ] - benchmark : fix calibrate-n option handling (Luan Muniz) #64146 [ 2e64293e3f ] - buffer : use Clamp conversion in Blob slice (Donghoon Kang) #64739 [ 5fda0958bd ] - buffer : validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904 [ 5298db40f9 ] - build : run perfetto build and test on GHA (Chengzhong Wu) #64721 [ e3eac7cef9 ] - build : fix v8_use_perfetto source scraping (Chengzhong Wu) #64721 [ ab5f076d7f ] - build : bump rustc requirement to >=1.86 (Renegade334) #64543 [ df608e061f ] - (SEMVER-MINOR) build : perfetto-sdk (Chengzhong Wu) #64565 [ 74928adc46 ] - build,tools : fix shared library cross-compile (Kirill Saied) #63963 [ 58717685a1 ] - (SEMVER-MINOR) crypto : support loading private keys through STORE loaders (Filip Skokan) #63949 [ 58d13b6f3d ] - crypto : preserve OpenSSL errors from KDF failures (Filip Skokan) #64776 [ 478a719cb5 ] - crypto : fix Argon2 bypassing FIPS mode (Filip Skokan) #64776 [ 44b940ee8c ] - crypto : update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [ fde85237c7 ] - crypto : clarify missing cipher error (Filip Skokan) #64852 [ c604d8846d ] - crypto : reuse X509 issuer result (Filip Skokan) #64852 [ c68c7d0112 ] - crypto : validate key generation options (Filip Skokan) #64852 [ c36bb1d017 ] - crypto : fix Argon2 validation errors (Filip Skokan) #64852 [ f61408bb27 ] - crypto : handle XOF output allocation failure (Filip Skokan) #64851 [ 2b4053d046 ] - crypto : initialize KeyObjectData mutex eagerly (Filip Skokan) #64851 [ 4b7b2adf44 ] - crypto : handle DH operation failures (Filip Skokan) #64851 [ 12170c3753 ] - crypto : use user-facing error for output encoding changes (Archkon) #64692 [ 474f06d550 ] - debugger : preserve overlapping CDP request state (Trivikram Kamat) #64467 [ 718cbe9497 ] - deps : upgrade npm to 11.19.0 (npm team) #64883 [ 657c6154b3 ] - deps : update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944 [ 75a1fbeff9 ] - deps : update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943 [ 07d7cb7cd8 ] - deps : update minimatch to 10.2.6 (Node.js GitHub Bot) #64945 [ f7d56359f1 ] - deps : update simdjson to 4.6.6 (Node.js GitHub Bot) #64942 [ 8b06457cfb ] - deps : update acorn to 8.18.0 (Node.js GitHub Bot) #64941 [ 5919d01525 ] - deps : update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940 [ 4a87ad6cff ] - deps : update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939 [ c96d76a7c8 ] - deps : update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744 [ 2b59984c0f ] - deps : V8: backport 5177b10891e6 (avivkeller) #64631 [ b839af91da ] - deps : update ada to 4.0.0 (Node.js GitHub Bot) #64790 [ 70dedef942 ] - deps : update sqlite to 3.53.4 (Node.js GitHub Bot) #64745 [ 7bc4c171f5 ] - deps : update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543 [ 308c6b2ac3 ] - deps : V8: backport 7d9b7e03141d (Manish Goregaokar) #64543 [ 8eeae28e88 ] - deps : V8: backport c4d06ba586f3 (liujiahui) #63731 [ bbd6fc58c4 ] - diagnostics_channel : grow native channel storage (Stephen Belanger) #64497 [ ce8b292955 ] - doc : fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957 [ 1a413a60cf ] - doc : fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952 [ 63fbd59e64 ] - doc : formalize fn/name as part of TestOptions API (Christopher Hiller) #64946 [ b263b0bca1 ] - doc
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 7 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
OPENJS FOUNDATION NODEJS-26.6.0
2026-08-03, Version 26.6.0 (Current), @aduh95 Notable Changes [ 5a36018abc ] - doc : add MikeMcC399 as collaborator (Mike McCready) #64656 [ 9b04f82d7b ] - (SEMVER-MINOR) ffi : add getCurrentEventLoop (Paolo Insogna) #64323 [ bb51f2c960 ] - (SEMVER-MINOR) test_runner : add context.log() and test:log event (Moshe Atlow) #64389 [ 56ce83b3ee ] - (SEMVER-MINOR) test_runner : report entryFile in TestStream events (Moshe Atlow) #64309 Commits [ 248ff9fa5c ] - assert,util : fix TypeError on Maps with null keys (Paul Bouchon) #64441 [ 3b5baceafe ] - benchmark : add bytes variant to webstreams async-iterator (Matteo Collina) #64291 [ 0a46d1ef66 ] - buffer : normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115 [ d9ada18b70 ] - buffer : fix Blob.stream() leaking source buffer (semimikoh) #63577 [ d05993bcf6 ] - build : merge multiple on download artifact (Chengzhong Wu) #64633 [ 6c25ac909a ] - build : extract temporal_capi crate directory name into gyp variable (René) #64482 [ 612f60c300 ] - cli : style node --help output with util.styleText (Adrián Estrada) #64484 [ 29a938ddbb ] - crypto : preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547 [ 2fde794357 ] - crypto : cleanse provider private key copies (Filip Skokan) #64547 [ 33a0e08d41 ] - crypto : handle incomplete RSA private keys (Filip Skokan) #64547 [ 11b4d505ef ] - crypto : retain legacy DH validation (Filip Skokan) #64547 [ 6e302041e1 ] - crypto : limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557 [ 195f103e87 ] - crypto : split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211 [ ec67e24eee ] - deps : update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587 [ 32ffff88fd ] - deps : histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296 [ e0664f1f09 ] - deps : update histogram to 0.11.10 (Node.js GitHub Bot) #64296 [ cf0622bdd6 ] - deps : update amaro to 1.1.11 (Node.js GitHub Bot) #64586 [ 04c78b8b24 ] - deps : update timezone to 2026c (Node.js GitHub Bot) #64588 [ 59f4318976 ] - deps : V8: cherry-pick 1158ae719749 (René) #64432 [ e5ea7cd299 ] - deps : update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439 [ 0e7554cee4 ] - deps : update libffi to 3.7.1 (Node.js GitHub Bot) #64438 [ 46c9d724ad ] - deps : update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297 [ 3519aac9af ] - deps : enable OpenSSL asm support for riscv64 (Jamie Magee) #62606 [ c09701218b ] - deps : update c-ares to 1.34.8 (Node.js GitHub Bot) #64330 [ ad2f3bc95b ] - deps : upgrade npm to 11.18.0 (npm team) #64199 [ d7a4b22c86 ] - deps : V8: backport a05321ebd98e (Chengzhong Wu) #64202 [ 8679cff291 ] - deps : update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295 [ df5b1e10ba ] - doc : remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649 [ 8a4ca9083f ] - doc : clarify rules for adding new built-in modules (Antoine du Hamel) #64648 [ 7d50fe6b7a ] - doc : mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634 [ 8f415bf5fc ] - doc : fix dnsPromises.lookup verbatim default (Shivam S) #64658 [ c6378f724d ] - doc : fix broken links and clean up type map (Antoine du Hamel) #64625 [ 9b53ec19a2 ] - doc : fix typo in releases guide (Jihwan) #64621 [ 5a36018abc ] - doc : add MikeMcC399 as collaborator (Mike McCready) #64656 [ d2c8acd764 ] - doc : use promote wording in release guide (Md Muhtasim Munif Fahim) #64371 [ 5c692cb576 ] - doc : fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112 [ 7568ce71ca ] - doc : mention crypto.hash() for better perf (Steven) #63420 [ cf3f631936 ] - doc : update sea example by fixing wrong code example (Maxence Robinet) #64025 [ ce21e567a4 ] - doc : fix socket.readyState state descriptions (YuSheng Chen) #64468 [ 018c7f1c01 ] - doc : replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582 [ cf82de8d8b ] - doc : note --env-file is not applied to --run (Paul Bouchon) #64442 [ e635ce5201 ] - doc : fix typo in embed
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
Source checked 7 Oct 2026 · verified
BlackTree update record →
Official publisher source ↗
Known exploited vulnerabilities Catalogue updated 14 Nov 2026
Matches use the product-family mapping against the CISA Known Exploited Vulnerabilities catalogue. They show vulnerabilities exploited in the wild, not every published CVE. Confirm the affected edition and release in the linked vendor advisory before acting.
No CISA known-exploited entries currently match this mapped product family.
This is not evidence that the product has no vulnerabilities. Review the vendor security advisories for a complete product and release assessment.
Evidence
PRIMARY Stale
Node.js release schedule Node.js 22 entered Maintenance LTS on 21 October 2025 and is scheduled to reach end of life on 30 April 2027.
Manually verified against the registered authoritative source.
Verified 24 Aug 2026 · Source checked 24 Aug 2026 · High confidence · Reviewer Lifecycle seed review
Open vendor source ↗
24 Aug 2026 Workflow State Representative private pilot catalogue seed.
published
