# Node.js: what changed from 24 to 26

- Product: Node.js (https://whatsnew.fyi/product/node-js)
- Vendor: OpenJS Foundation
- Range: changelog entries numbered after v24.20.0 up to and including v26.8.1, stable releases only
- Entries below: 10 releases (newest first)
- Resolved: 24 is v24.20.0 and 26 is v26.8.1, the newest stable release of each major we track
- Carrying security changes: 6 · CVEs mentioned: 21 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/node-js/compare/24...26

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (133 changes, grouped by kind)

### Added

#### v26.8.0 (2026-08-26)

- add --analyze mode to compare.js benchmark tool
- enable SIV and GCM-SIV modes in Cipher/Decipher APIs
- add statistical hypothesis testing to histogram in perf_hooks
- add basic syntax highlighting to REPL
- add StatementSync.prototype.close() to sqlite
- add StatementSync.prototype[Symbol.dispose]() to sqlite
- add non-throwing MIMEType.parse to util
- add ZipEntry, ZipFile, and ZipBuffer to zlib
- support aligned allocations in buffer

#### v26.7.0 (2026-08-05)

- Support loading private keys through STORE loaders in crypto
- Add perfetto support to lib
- Implement Symbol.dispose in ModuleHooks
- Add support for --test-coverage-include-all flag in test runner

#### v26.6.0 (2026-08-03)

- Add `getCurrentEventLoop` to ffi
- Add `context.log()` and `test:log` event to test runner
- Report `entryFile` in `TestStream` events

#### v26.5.0 (2026-07-08)

- Implement blob.textStream() in buffer
- Add --experimental-import-text flag to esm
- Sample delay per event loop iteration in perf_hooks
- Expose ReadableStreamTee in stream
- Report negotiated TLS groups in tls
- Add fast api for isUtf8 and isAscii in buffer

#### v26.4.0 (2026-06-24)

- Support caller-supplied buffers in fs.readFile()
- Close pre-request sockets in http.closeIdleConnections()
- Implement package maps in loader
- Support TCP_KEEPINTVL and TCP_KEEPCNT in net.setKeepAlive()
- Add certificateCompression option to tls
- Dispatch node:fs/promises to mounted VFS instances
- Add minimal node:vfs subsystem
- Support non-byte WebCrypto lengths and cSHAKE

#### v26.3.0 (2026-06-01)

- Add httpValidation option to configure header value validation
- Expose precise coverage start to JS runtime in inspector
- Add permission.drop to permission system

#### v26.2.0 (2026-05-20)

- Add Temporal.Instant support to Stats and BigIntStats
- Add writeInformation to http module to send arbitrary 1xx status codes
- Wire ML-DSA and ML-KEM for use when using BoringSSL
- Wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL
- Wire AES-KW in Web Cryptography when using BoringSSL
- Add --help to node inspect and improve docs

### Changed

#### v26.8.0 (2026-08-26)

- update root certificates to NSS 3.126
- mark TracingChannel as stable
- improve histogram implementation
- improve performance of net.BlockList
- target Power 9 and z14 in build

#### v26.7.0 (2026-08-05)

- Update root certificates to NSS 3.125
- Bump rustc requirement to >=1.86

#### v26.6.0 (2026-08-03)

- Style node --help output with util.styleText
- Split OpenSSL 3, BoringSSL, and legacy backends
- Update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d
- Update histogram to 0.11.10
- Update amaro to 1.1.11
- Update timezone to 2026c
- Update libffi to 3.7.1
- Update ngtcp2 to 1.24.0
- Enable OpenSSL asm support for riscv64

#### v26.5.1 (2026-07-29)

- Update llhttp to 9.4.3
- Update undici to 8.9.0

#### v26.4.0 (2026-06-24)

- Update blockList stability status to release candidate
- Optimize Buffer.prototype.copy
- Use simdutf for two-byte utf8 byteLength
- Enable maglev by default on Linux ppc64le
- Pass spawn options to the binding positionally in child_process
- Serialize advanced IPC messages natively in child_process
- Use EVP_MAC for HMAC on OpenSSL >=3
- Make webcrypto aliasKeyFormat directional

#### v26.3.0 (2026-06-01)

- Increase Buffer.poolSize default to 64 KiB
- Update root certificates to NSS 3.123.1
- Remove async from WebCrypto methods

#### v26.2.0 (2026-05-20)

- Mark stream.compose as stable
- Align verifyOneShot accepted types in crypto
- Improve system certificate enumeration logic on macOS
- Improve accuracy of SubtleCrypto.supports
- Optimize normalizeAlgorithm dispatch hot path

### Fixed

#### v26.8.1 (2026-08-26)

- Fixed node --version reporting an alpha version designation

#### v26.8.0 (2026-08-26)

- prevent string write offset overflow in buffer
- treat detached ArrayBuffers as empty in buffer

#### v26.7.0 (2026-08-05)

- Use Clamp conversion in Blob slice
- Validate copyArrayBuffer offsets against buffer length
- Preserve OpenSSL errors from KDF failures
- Fix Argon2 bypassing FIPS mode
- Clarify missing cipher error
- Validate key generation options
- Fix Argon2 validation errors
- Handle XOF output allocation failure
- Initialize KeyObjectData mutex eagerly
- Handle DH operation failures
- Use user-facing error for output encoding changes
- Preserve overlapping CDP request state in debugger

#### v26.6.0 (2026-08-03)

- Fix TypeError on Maps with null keys in assert and util
- Normalize lone "\r" in Blob native line endings
- Fix Blob.stream() leaking source buffer

#### v26.5.0 (2026-07-08)

- Remove unreachable overflow check in buffer.atob()
- Fix permission model propagation via NODE_OPTIONS in child_process
- Fix large DH generator validation in crypto
- Skip dns.lookup() for literal IP addresses in dgram
- Return original thenable in diagnostics_channel

#### v26.4.0 (2026-06-24)

- Fix unhandled error in Hash._transform
- Handle cipher context allocation failures

#### v26.3.0 (2026-06-01)

- Coerce -0 keylen to +0 in pbkdf2 and scrypt
- Surface inspector failures in probe mode in debugger

#### v26.2.0 (2026-05-20)

- Reject invalid raw key imports
- Disambiguate probe location binding in debugger

### Deprecated

#### v26.8.0 (2026-08-26)

- deprecate always enabled --enable-static build option

### Security

#### v26.6.0 (2026-08-03)

- Preserve RSA-PSS legacy pubkey DER
- Cleanse provider private key copies
- Handle incomplete RSA private keys
- Retain legacy DH validation
- Limit KangarooTwelveParams customization to 512 bytes

#### v26.5.1 (2026-07-29)

- Defer rst stream while in scope in http2 module (CVE-2026-56848)
- Avoid granting radix split nodes in permission module (CVE-2026-58043)
- Distinguish PFX object-array agent keys in https module (CVE-2026-56850)
- Bind identity checks to session reuse in https module (CVE-2026-58040)
- Invalidate tag store iterators on statement reset in sqlite module (CVE-2026-58041)
- Handle large resolveAny address replies in dns module (CVE-2026-58042)
- Throw on out-of-bounds write buffers in zlib module (CVE-2026-58045)
- Enforce fs write permission for trace events in permission module (CVE-2026-56847)
- Check final report output path in permission module (CVE-2026-58039)
- Reject requests exceeding max header count in http module (CVE-2026-58044)

#### v26.5.0 (2026-07-08)

- Reject small-order EdDSA points during verify in crypto

#### v26.3.1 (2026-06-18)

- Normalize hostname for server identity checks in tls (CVE-2026-48618)
- Guard WebCrypto cipher output length in crypto (CVE-2026-48933)
- Redact proxy credentials in tunnel errors (CVE-2026-48615)
- Cap originSet size to prevent unbounded memory growth in http2 (CVE-2026-48619)
- Fix case-sensitive SNI context matching in tls (CVE-2026-48928)
- Reject hostnames with embedded NUL bytes in dns and net (CVE-2026-48930)
- Bind reusable sessions to authenticated host in tls (CVE-2026-48934)
- Handle process.chdir on writereport in permission (CVE-2026-48617)
- Fix response queue poisoning in http.Agent (CVE-2026-48931)
- Disable FileHandle utimes with permission model (CVE-2026-48935)
- Guard pipe open and chmod with net scope in permission (CVE-2026-48936)

#### v26.3.0 (2026-06-01)

- Harden WebCrypto against prototype pollution

#### v26.2.0 (2026-05-20)

- Harden CryptoKey algorithm slots
- Harden KeyObject internal slots

## Release notes

### v26.8.1 — 2026-08-26, Version 26.8.1 (Current), @aduh95

- Date: 2026-08-26
- Version: v26.8.1
- Original notes: https://github.com/nodejs/node/releases/tag/v26.8.1
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.8.1

- **fixed** — Fixed node --version reporting an alpha version designation

###### Notable Changes

Out-of-band release to fix `node --version` which was reporting an alpha version.

###### Commits

* \[[`ebd35a9eec`](https://github.com/nodejs/node/commit/ebd35a9eec)] - **src**: revert accidental alpha designation (Antoine du Hamel) [#65568](https://github.com/nodejs/node/pull/65568)
* \[[`0b0dd87fcc`](https://github.com/nodejs/node/commit/0b0dd87fcc)] - **tools**: fix `tools/nix/list-requisites.sh` (Antoine du Hamel) [#65560](https://github.com/nodejs/node/pull/65560)

### v26.8.0 — 2026-08-26, Version 26.8.0 (Current), @aduh95

- Date: 2026-08-26
- Version: v26.8.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.8.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.8.0

- **added** — add --analyze mode to compare.js benchmark tool
- **changed** — update root certificates to NSS 3.126
- **added** — enable SIV and GCM-SIV modes in Cipher/Decipher APIs
- **changed** — mark TracingChannel as stable
- **changed** — improve histogram implementation
- **changed** — improve performance of net.BlockList
- **added** — add statistical hypothesis testing to histogram in perf_hooks
- **added** — add basic syntax highlighting to REPL
- **added** — add StatementSync.prototype.close() to sqlite
- **added** — add StatementSync.prototype[Symbol.dispose]() to sqlite
- **added** — add non-throwing MIMEType.parse to util
- **added** — add ZipEntry, ZipFile, and ZipBuffer to zlib
- **fixed** — prevent string write offset overflow in buffer
- **added** — support aligned allocations in buffer
- **fixed** — treat detached ArrayBuffers as empty in buffer
- **changed** — target Power 9 and z14 in build
- **deprecated** — deprecate always enabled --enable-static build option

###### Notable Changes

* \[[`74234ee30e`](https://github.com/nodejs/node/commit/74234ee30e)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
* \[[`4232997fa2`](https://github.com/nodejs/node/commit/4232997fa2)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
* \[[`f0531f1c87`](https://github.com/nodejs/node/commit/f0531f1c87)] - **(SEMVER-MINOR)** **crypto**: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) [#63411](https://github.com/nodejs/node/pull/63411)
* \[[`3f4b80ebb5`](https://github.com/nodejs/node/commit/3f4b80ebb5)] - **diagnostics\_channel**: mark TracingChannel as stable (Abdelrahman Awad) [#64525](https://github.com/nodejs/node/pull/64525)
* \[[`753033c110`](https://github.com/nodejs/node/commit/753033c110)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
* \[[`3d7d277493`](https://github.com/nodejs/node/commit/3d7d277493)] - **(SEMVER-MINOR)** **net**: improve performance of net.BlockList (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
* \[[`9e8e9080fd`](https://github.com/nodejs/node/commit/9e8e9080fd)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
* \[[`c18b0aa54e`](https://github.com/nodejs/node/commit/c18b0aa54e)] - **repl**: add basic syntax highlighting (Aviv Keller) [#64591](https://github.com/nodejs/node/pull/64591)
* \[[`58ea88e1d3`](https://github.com/nodejs/node/commit/58ea88e1d3)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype.close() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
* \[[`7c61b08aed`](https://github.com/nodejs/node/commit/7c61b08aed)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype\[Symbol.dispose]\() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
* \[[`4299cd5897`](https://github.com/nodejs/node/commit/4299cd5897)] - **(SEMVER-MINOR)** **util**: add non-throwing MIMEType.parse (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
* \[[`df48191061`](https://github.com/nodejs/node/commit/df48191061)] - **(SEMVER-MINOR)** **zlib**: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) [#64339](https://github.com/nodejs/node/pull/64339)

###### Commits

* \[[`162257b403`](https://github.com/nodejs/node/commit/162257b403)] - **assert**: improve documentation wording (Kamal Rawal) [#64953](https://github.com/nodejs/node/pull/64953)
* \[[`74234ee30e`](https://github.com/nodejs/node/commit/74234ee30e)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
* \[[`2cb96dd462`](https://github.com/nodejs/node/commit/2cb96dd462)] - **benchmark**: add test-only and mock timers cases (Luan Muniz) [#64097](https://github.com/nodejs/node/pull/64097)
* \[[`562168f93f`](https://github.com/nodejs/node/commit/562168f93f)] - **benchmark**: apply `highWaterMark` in webstreams `pipe-to` (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
* \[[`fbec4eb386`](https://github.com/nodejs/node/commit/fbec4eb386)] - **benchmark**: complete the sqlite is-transaction fix (Edy Silva) [#65218](https://github.com/nodejs/node/pull/65218)
* \[[`d8acfc45f1`](https://github.com/nodejs/node/commit/d8acfc45f1)] - **benchmark**: add test runner hooks and options (Luan Muniz) [#63754](https://github.com/nodejs/node/pull/63754)
* \[[`13e7d54f67`](https://github.com/nodejs/node/commit/13e7d54f67)] - **buffer**: prevent string write offset overflow (Matteo Collina) [#65043](https://github.com/nodejs/node/pull/65043)
* \[[`615273deac`](https://github.com/nodejs/node/commit/615273deac)] - **buffer**: support aligned allocations (Robert Nagy) [#65003](https

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.8.0]_

### v26.7.0 — 2026-08-05, Version 26.7.0 (Current), @aduh95

- Date: 2026-08-05
- Version: v26.7.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.7.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.7.0

- **added** — Support loading private keys through STORE loaders in crypto
- **added** — Add perfetto support to lib
- **added** — Implement Symbol.dispose in ModuleHooks
- **added** — Add support for --test-coverage-include-all flag in test runner
- **changed** — Update root certificates to NSS 3.125
- **changed** — Bump rustc requirement to >=1.86
- **fixed** — Use Clamp conversion in Blob slice
- **fixed** — Validate copyArrayBuffer offsets against buffer length
- **fixed** — Preserve OpenSSL errors from KDF failures
- **fixed** — Fix Argon2 bypassing FIPS mode
- **fixed** — Clarify missing cipher error
- **fixed** — Validate key generation options
- **fixed** — Fix Argon2 validation errors
- **fixed** — Handle XOF output allocation failure
- **fixed** — Initialize KeyObjectData mutex eagerly
- **fixed** — Handle DH operation failures
- **fixed** — Use user-facing error for output encoding changes
- **fixed** — Preserve overlapping CDP request state in debugger

###### Notable Changes

* \[[`58717685a1`](https://github.com/nodejs/node/commit/58717685a1)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
* \[[`44b940ee8c`](https://github.com/nodejs/node/commit/44b940ee8c)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](https://github.com/nodejs/node/pull/64746)
* \[[`c1e4f7365e`](https://github.com/nodejs/node/commit/c1e4f7365e)] - **(SEMVER-MINOR)** **lib**: add perfetto support (Chengzhong Wu) [#64565](https://github.com/nodejs/node/pull/64565)
* \[[`11c2f9c642`](https://github.com/nodejs/node/commit/11c2f9c642)] - **(SEMVER-MINOR)** **module**: implement `Symbol.dispose` in `ModuleHooks` (Remco Haszing) [#63928](https://github.com/nodejs/node/pull/63928)
* \[[`a646319f61`](https://github.com/nodejs/node/commit/a646319f61)] - **(SEMVER-MINOR)** **test\_runner**: add support for `--test-coverage-include-all` (avivkeller) [#64830](https://github.com/nodejs/node/pull/64830)

###### Commits

* \[[`a2d3f891d3`](https://github.com/nodejs/node/commit/a2d3f891d3)] - **async\_hooks**: use validateBoolean for trackPromises (Soul Lee) [#64731](https://github.com/nodejs/node/pull/64731)
* \[[`d7266cdd99`](https://github.com/nodejs/node/commit/d7266cdd99)] - **benchmark**: fix calibrate-n option handling (Luan Muniz) [#64146](https://github.com/nodejs/node/pull/64146)
* \[[`2e64293e3f`](https://github.com/nodejs/node/commit/2e64293e3f)] - **buffer**: use Clamp conversion in Blob slice (Donghoon Kang) [#64739](https://github.com/nodejs/node/pull/64739)
* \[[`5fda0958bd`](https://github.com/nodejs/node/commit/5fda0958bd)] - **buffer**: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) [#63904](https://github.com/nodejs/node/pull/63904)
* \[[`5298db40f9`](https://github.com/nodejs/node/commit/5298db40f9)] - **build**: run perfetto build and test on GHA (Chengzhong Wu) [#64721](https://github.com/nodejs/node/pull/64721)
* \[[`e3eac7cef9`](https://github.com/nodejs/node/commit/e3eac7cef9)] - **build**: fix v8\_use\_perfetto source scraping (Chengzhong Wu) [#64721](https://github.com/nodejs/node/pull/64721)
* \[[`ab5f076d7f`](https://github.com/nodejs/node/commit/ab5f076d7f)] - **build**: bump rustc requirement to >=1.86 (Renegade334) [#64543](https://github.com/nodejs/node/pull/64543)
* \[[`df608e061f`](https://github.com/nodejs/node/commit/df608e061f)] - **(SEMVER-MINOR)** **build**: perfetto-sdk (Chengzhong Wu) [#64565](https://github.com/nodejs/node/pull/64565)
* \[[`74928adc46`](https://github.com/nodejs/node/commit/74928adc46)] - **build,tools**: fix shared library cross-compile (Kirill Saied) [#63963](https://github.com/nodejs/node/pull/63963)
* \[[`58717685a1`](https://github.com/nodejs/node/commit/58717685a1)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
* \[[`58d13b6f3d`](https://github.com/nodejs/node/commit/58d13b6f3d)] - **crypto**: preserve OpenSSL errors from KDF failures (Filip Skokan) [#64776](https://github.com/nodejs/node/pull/64776)
* \[[`478a719cb5`](https://github.com/nodejs/node/commit/478a719cb5)] - **crypto**: fix Argon2 bypassing FIPS mode (Filip Skokan) [#64776](https://github.com/nodejs/node/pull/64776)
* \[[`44b940ee8c`](https://github.com/nodejs/node/commit/44b940ee8c)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](https://github.com/nodejs/node/pull/64746)
* \[[`fde85237c7`](https://github.com/nodejs/node/commit/fde85237c7)] - **crypto**: clarify missing cipher error (Filip Skokan) [#64852](https://github.com/nodejs/node/pull/64852)
* \[[`c604d8846d`](https://github.com/nodejs/node/commit/c604d8846d)] - **crypto**: reuse X509 issuer result (Filip Skokan) [#64852](https://github.com/nodejs/node/pull/64852)
* \[[`c68c7d0112`](https://github.com/nodejs/node/commit/c68c7d0112)] -

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.7.0]_

### v26.6.0 — 2026-08-03, Version 26.6.0 (Current), @aduh95

- Date: 2026-08-03
- Version: v26.6.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.6.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.6.0

- **added** — Add `getCurrentEventLoop` to ffi
- **added** — Add `context.log()` and `test:log` event to test runner
- **added** — Report `entryFile` in `TestStream` events
- **fixed** — Fix TypeError on Maps with null keys in assert and util
- **fixed** — Normalize lone "\r" in Blob native line endings
- **fixed** — Fix Blob.stream() leaking source buffer
- **changed** — Style node --help output with util.styleText
- **security** — Preserve RSA-PSS legacy pubkey DER
- **security** — Cleanse provider private key copies
- **security** — Handle incomplete RSA private keys
- **security** — Retain legacy DH validation
- **security** — Limit KangarooTwelveParams customization to 512 bytes
- **changed** — Split OpenSSL 3, BoringSSL, and legacy backends
- **changed** — Update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d
- **changed** — Update histogram to 0.11.10
- **changed** — Update amaro to 1.1.11
- **changed** — Update timezone to 2026c
- **changed** — Update libffi to 3.7.1
- **changed** — Update ngtcp2 to 1.24.0
- **changed** — Enable OpenSSL asm support for riscv64

###### Notable Changes

* \[[`5a36018abc`](https://github.com/nodejs/node/commit/5a36018abc)] - **doc**: add MikeMcC399 as collaborator (Mike McCready) [#64656](https://github.com/nodejs/node/pull/64656)
* \[[`9b04f82d7b`](https://github.com/nodejs/node/commit/9b04f82d7b)] - **(SEMVER-MINOR)** **ffi**: add `getCurrentEventLoop` (Paolo Insogna) [#64323](https://github.com/nodejs/node/pull/64323)
* \[[`bb51f2c960`](https://github.com/nodejs/node/commit/bb51f2c960)] - **(SEMVER-MINOR)** **test\_runner**: add `context.log()` and `test:log` event (Moshe Atlow) [#64389](https://github.com/nodejs/node/pull/64389)
* \[[`56ce83b3ee`](https://github.com/nodejs/node/commit/56ce83b3ee)] - **(SEMVER-MINOR)** **test\_runner**: report `entryFile` in `TestStream` events (Moshe Atlow) [#64309](https://github.com/nodejs/node/pull/64309)

###### Commits

* \[[`248ff9fa5c`](https://github.com/nodejs/node/commit/248ff9fa5c)] - **assert,util**: fix TypeError on Maps with null keys (Paul Bouchon) [#64441](https://github.com/nodejs/node/pull/64441)
* \[[`3b5baceafe`](https://github.com/nodejs/node/commit/3b5baceafe)] - **benchmark**: add bytes variant to webstreams async-iterator (Matteo Collina) [#64291](https://github.com/nodejs/node/pull/64291)
* \[[`0a46d1ef66`](https://github.com/nodejs/node/commit/0a46d1ef66)] - **buffer**: normalize lone "\r" in Blob native line endings (Daijiro Wachi) [#64115](https://github.com/nodejs/node/pull/64115)
* \[[`d9ada18b70`](https://github.com/nodejs/node/commit/d9ada18b70)] - **buffer**: fix Blob.stream() leaking source buffer (semimikoh) [#63577](https://github.com/nodejs/node/pull/63577)
* \[[`d05993bcf6`](https://github.com/nodejs/node/commit/d05993bcf6)] - **build**: merge multiple on download artifact (Chengzhong Wu) [#64633](https://github.com/nodejs/node/pull/64633)
* \[[`6c25ac909a`](https://github.com/nodejs/node/commit/6c25ac909a)] - **build**: extract temporal\_capi crate directory name into gyp variable (René) [#64482](https://github.com/nodejs/node/pull/64482)
* \[[`612f60c300`](https://github.com/nodejs/node/commit/612f60c300)] - **cli**: style node --help output with util.styleText (Adrián Estrada) [#64484](https://github.com/nodejs/node/pull/64484)
* \[[`29a938ddbb`](https://github.com/nodejs/node/commit/29a938ddbb)] - **crypto**: preserve RSA-PSS legacy pubkey DER (Filip Skokan) [#64547](https://github.com/nodejs/node/pull/64547)
* \[[`2fde794357`](https://github.com/nodejs/node/commit/2fde794357)] - **crypto**: cleanse provider private key copies (Filip Skokan) [#64547](https://github.com/nodejs/node/pull/64547)
* \[[`33a0e08d41`](https://github.com/nodejs/node/commit/33a0e08d41)] - **crypto**: handle incomplete RSA private keys (Filip Skokan) [#64547](https://github.com/nodejs/node/pull/64547)
* \[[`11b4d505ef`](https://github.com/nodejs/node/commit/11b4d505ef)] - **crypto**: retain legacy DH validation (Filip Skokan) [#64547](https://github.com/nodejs/node/pull/64547)
* \[[`6e302041e1`](https://github.com/nodejs/node/commit/6e302041e1)] - **crypto**: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) [#64557](https://github.com/nodejs/node/pull/64557)
* \[[`195f103e87`](https://github.com/nodejs/node/commit/195f103e87)] - **crypto**: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) [#64211](https://github.com/nodejs/node/pull/64211)
* \[[`ec67e24eee`](https://github.com/nodejs/node/commit/ec67e24eee)] - **deps**: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) [#64587](https://github.com/nodejs/node/pull/64587)
* \[[`32ffff88fd`](https://github.com/nodejs/node/commit/32ffff88fd)] - **deps**: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) [#64296](https://github.com/nodejs/node/pull/64296)
* \[[`e0664f1f09`](https://github.com/nodejs/node/commit/e0664f1f09)] - **deps**: update histogram to 0.11.10 (Node.js GitHub Bot) [#64296](https://github.com/nodejs/node/pull/64296)
* \[[`cf0622bdd6`](https://github.com/nodejs/no

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.6.0]_

### v26.5.1 — 2026-07-29, Version 26.5.1 (Current), @RafaelGSS

- Date: 2026-07-29
- Version: v26.5.1
- Original notes: https://github.com/nodejs/node/releases/tag/v26.5.1
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.5.1

- **security** — Defer rst stream while in scope in http2 module (CVE-2026-56848)
- **security** — Avoid granting radix split nodes in permission module (CVE-2026-58043)
- **security** — Distinguish PFX object-array agent keys in https module (CVE-2026-56850)
- **security** — Bind identity checks to session reuse in https module (CVE-2026-58040)
- **security** — Invalidate tag store iterators on statement reset in sqlite module (CVE-2026-58041)
- **security** — Handle large resolveAny address replies in dns module (CVE-2026-58042)
- **security** — Throw on out-of-bounds write buffers in zlib module (CVE-2026-58045)
- **security** — Enforce fs write permission for trace events in permission module (CVE-2026-56847)
- **security** — Check final report output path in permission module (CVE-2026-58039)
- **security** — Reject requests exceeding max header count in http module (CVE-2026-58044)
- **changed** — Update llhttp to 9.4.3
- **changed** — Update undici to 8.9.0

This is a security release.

###### Notable Changes

* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 8.9.0 (Node.js GitHub Bot)

###### Commits

* \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
* \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712)
* \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
* \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
* \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
* \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
* \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
* \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
* \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908)
* \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924)
* \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
* \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)

### v26.5.0 — 2026-07-08, Version 26.5.0 (Current), @richardlau

- Date: 2026-07-08
- Version: v26.5.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.5.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.5.0

- **added** — Implement blob.textStream() in buffer
- **added** — Add --experimental-import-text flag to esm
- **added** — Sample delay per event loop iteration in perf_hooks
- **added** — Expose ReadableStreamTee in stream
- **added** — Report negotiated TLS groups in tls
- **fixed** — Remove unreachable overflow check in buffer.atob()
- **added** — Add fast api for isUtf8 and isAscii in buffer
- **fixed** — Fix permission model propagation via NODE_OPTIONS in child_process
- **fixed** — Fix large DH generator validation in crypto
- **security** — Reject small-order EdDSA points during verify in crypto
- **fixed** — Skip dns.lookup() for literal IP addresses in dgram
- **fixed** — Return original thenable in diagnostics_channel

###### Notable Changes

###### New release key

Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.

###### Other notable changes

* \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
* \[[`b373202efc`](https://github.com/nodejs/node/commit/b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300)
* \[[`39e0c14455`](https://github.com/nodejs/node/commit/39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935)
* \[[`999a83c937`](https://github.com/nodejs/node/commit/999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195)
* \[[`4e0236dc3d`](https://github.com/nodejs/node/commit/4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119)

###### Commits

* \[[`87648c0a6c`](https://github.com/nodejs/node/commit/87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](https://github.com/nodejs/node/pull/64218)
* \[[`a483bfd3f0`](https://github.com/nodejs/node/commit/a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](https://github.com/nodejs/node/pull/60161)
* \[[`6d14279688`](https://github.com/nodejs/node/commit/6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](https://github.com/nodejs/node/pull/64169)
* \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
* \[[`a67d9a7a44`](https://github.com/nodejs/node/commit/a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#64157](https://github.com/nodejs/node/pull/64157)
* \[[`06c1fbc25b`](https://github.com/nodejs/node/commit/06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#62605](https://github.com/nodejs/node/pull/62605)
* \[[`518309c363`](https://github.com/nodejs/node/commit/518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#64222](https://github.com/nodejs/node/pull/64222)
* \[[`6a80ab485c`](https://github.com/nodejs/node/commit/6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#64118](https://github.com/nodejs/node/pull/64118)
* \[[`f4e7bf1f1c`](https://github.com/nodejs/node/commit/f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#64117](https://github.com/nodejs/node/pull/64117)
* \[[`66f6ac0d86`](https://github.com/nodejs/node/commit/66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#53899](https://github.com/nodejs/node/pull/53899)
* \[[`7f26c54aa6`](https://github.com/nodejs/node/commit/7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#63972](https://github.com/nodejs/node/pull/63972)
* \[[`32bb554f5b`](https://github.com/nodejs/node/commit/32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#64092](https://github.com/nodejs/node/pull/64092)
* \[[`0908d76ef6`](https://github.com/nodejs/node/commit/0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#64026](https://github.com/nodejs/node/pull/64026)
* \[[`7f7e5863c2`](https://github.com/nodejs/node/commit/7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#64282](https://github

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.5.0]_

### v26.4.0 — 2026-06-24, Version 26.4.0 (Current), @aduh95

- Date: 2026-06-24
- Version: v26.4.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.4.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.4.0

- **changed** — Update blockList stability status to release candidate
- **added** — Support caller-supplied buffers in fs.readFile()
- **added** — Close pre-request sockets in http.closeIdleConnections()
- **added** — Implement package maps in loader
- **added** — Support TCP_KEEPINTVL and TCP_KEEPCNT in net.setKeepAlive()
- **added** — Add certificateCompression option to tls
- **added** — Dispatch node:fs/promises to mounted VFS instances
- **added** — Add minimal node:vfs subsystem
- **changed** — Optimize Buffer.prototype.copy
- **changed** — Use simdutf for two-byte utf8 byteLength
- **changed** — Enable maglev by default on Linux ppc64le
- **changed** — Pass spawn options to the binding positionally in child_process
- **changed** — Serialize advanced IPC messages natively in child_process
- **added** — Support non-byte WebCrypto lengths and cSHAKE
- **changed** — Use EVP_MAC for HMAC on OpenSSL >=3
- **changed** — Make webcrypto aliasKeyFormat directional
- **fixed** — Fix unhandled error in Hash._transform
- **fixed** — Handle cipher context allocation failures

###### Notable Changes

* \[[`cde0daabcc`](https://github.com/nodejs/node/commit/cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](https://github.com/nodejs/node/pull/63050)
* \[[`b78f5a7537`](https://github.com/nodejs/node/commit/b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](https://github.com/nodejs/node/pull/63634)
* \[[`417aacbc36`](https://github.com/nodejs/node/commit/417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](https://github.com/nodejs/node/pull/63470)
* \[[`fbb108be7d`](https://github.com/nodejs/node/commit/fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](https://github.com/nodejs/node/pull/62239)
* \[[`45494d5a8a`](https://github.com/nodejs/node/commit/45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](https://github.com/nodejs/node/pull/63825)
* \[[`ee29465e77`](https://github.com/nodejs/node/commit/ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217)
* \[[`b17817eb2b`](https://github.com/nodejs/node/commit/b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](https://github.com/nodejs/node/pull/63537)
* \[[`7bc93a6ac5`](https://github.com/nodejs/node/commit/7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](https://github.com/nodejs/node/pull/63115)

###### Commits

* \[[`c7eb83b46a`](https://github.com/nodejs/node/commit/c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](https://github.com/nodejs/node/pull/63929)
* \[[`066fff17a5`](https://github.com/nodejs/node/commit/066fff17a5)] - **benchmark**: remove old alias usage in ffi benchmarks (Anna Henningsen) [#63666](https://github.com/nodejs/node/pull/63666)
* \[[`509cd1b94f`](https://github.com/nodejs/node/commit/509cd1b94f)] - **buffer**: optimize Buffer.prototype.copy (Robert Nagy) [#63828](https://github.com/nodejs/node/pull/63828)
* \[[`86e651bbd0`](https://github.com/nodejs/node/commit/86e651bbd0)] - **buffer**: use simdutf for two-byte utf8 byteLength (Mert Can Altin) [#63639](https://github.com/nodejs/node/pull/63639)
* \[[`d3f4ed9015`](https://github.com/nodejs/node/commit/d3f4ed9015)] - **build**: suppress compiler warnings for histogram (Richard Lau) [#63980](https://github.com/nodejs/node/pull/63980)
* \[[`82dd7ddbe6`](https://github.com/nodejs/node/commit/82dd7ddbe6)] - **build**: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) [#63875](https://github.com/nodejs/node/pull/63875)
* \[[`1124c0652d`](https://github.com/nodejs/node/commit/1124c0652d)] - **build**: remove redundant intermediate node\_aix\_shared (Chengzhong Wu) [#63747](https://github.com/nodejs/node/pull/63747)
* \[[`e510ee8087`](https://github.com/nodejs/node/commit/e510ee8087)] - **build**: build codecache and snapshot with libnode (Chengzhong Wu) [#63626](https://github.com/nodejs/node/pull/63626)
* \[[`5b583dace5`](https://github.com/nodejs/node/commit/5b583dace5)] - **build**: enable maglev by default on Linux ppc64le (Richard Lau) [#63474](https://github.com/nodejs/node/pull/63474)
* \[[`a2324246b4`](https://github.com/nodejs/node/commit/a2324246b4)] - **build**: remove duplicated node\_use\_sqlite and node\_use\_ffi conditions (Chengzhong Wu) [#63629](https://github.com/nodejs/node/pull/63629)
* \[[`2a467a5f69`](https://github.com/nodejs/node/commit/2a467a5f69)] - _**Revert**_ "**build, doc**: generate node.1 with doc-kit" (Antoine du Hamel) [#64091](https://github.com/nodejs/node/pull/64091)
* \[[`e01dec45b8`](https://github.com/nodejs/node/commit/e01dec45b8)] - **build, doc**: generate node.1

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.4.0]_

### v26.3.1 — 2026-06-18, Version 26.3.1 (Current), @aduh95

- Date: 2026-06-18
- Version: v26.3.1
- Original notes: https://github.com/nodejs/node/releases/tag/v26.3.1
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.3.1

- **security** — Normalize hostname for server identity checks in tls (CVE-2026-48618)
- **security** — Guard WebCrypto cipher output length in crypto (CVE-2026-48933)
- **security** — Redact proxy credentials in tunnel errors (CVE-2026-48615)
- **security** — Cap originSet size to prevent unbounded memory growth in http2 (CVE-2026-48619)
- **security** — Fix case-sensitive SNI context matching in tls (CVE-2026-48928)
- **security** — Reject hostnames with embedded NUL bytes in dns and net (CVE-2026-48930)
- **security** — Bind reusable sessions to authenticated host in tls (CVE-2026-48934)
- **security** — Handle process.chdir on writereport in permission (CVE-2026-48617)
- **security** — Fix response queue poisoning in http.Agent (CVE-2026-48931)
- **security** — Disable FileHandle utimes with permission model (CVE-2026-48935)
- **security** — Guard pipe open and chmod with net scope in permission (CVE-2026-48936)

This is a security release.

###### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

###### Commits

* \[[`98fbc89211`](https://github.com/nodejs/node/commit/98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`110840f2c7`](https://github.com/nodejs/node/commit/110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`8d36d522b2`](https://github.com/nodejs/node/commit/8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](https://github.com/nodejs/node/pull/63903)
* \[[`2e6d03993a`](https://github.com/nodejs/node/commit/2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](https://github.com/nodejs/node/pull/63779)
* \[[`5a17d5b07a`](https://github.com/nodejs/node/commit/5a17d5b07a)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`362725d4e5`](https://github.com/nodejs/node/commit/362725d4e5)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`bd1214ab01`](https://github.com/nodejs/node/commit/bd1214ab01)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
* \[[`bc0b53813e`](https://github.com/nodejs/node/commit/bc0b53813e)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
* \[[`87d847bc70`](https://github.com/nodejs/node/commit/87d847bc70)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
* \[[`9308084fcb`](https://github.com/nodejs/node/commit/9308084fcb)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
* \[[`a67dd46891`](https://github.com/nodejs/node/commit/a67dd46891)] - **(CVE-2026-48936)** **permission**: guard pipe open and chmod with net scope (RafaelGSS) [nodejs-private/node-private#885](https://github.com/nodejs-private/node-private/pull/885)
* \[[`7057c3f16c`](https://github.com/nodejs/node/commit/7057c3f16c)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
* \[[`6bc17a6b51`](https://github.com/nodejs/node/commit/6bc17a6b51)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (Rafael

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.3.1]_

### v26.3.0 — 2026-06-01, Version 26.3.0 (Current), @aduh95

- Date: 2026-06-01
- Version: v26.3.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.3.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.3.0

- **changed** — Increase Buffer.poolSize default to 64 KiB
- **changed** — Update root certificates to NSS 3.123.1
- **added** — Add httpValidation option to configure header value validation
- **added** — Expose precise coverage start to JS runtime in inspector
- **added** — Add permission.drop to permission system
- **fixed** — Coerce -0 keylen to +0 in pbkdf2 and scrypt
- **security** — Harden WebCrypto against prototype pollution
- **changed** — Remove async from WebCrypto methods
- **fixed** — Surface inspector failures in probe mode in debugger

###### Notable Changes

###### Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in [#63055](https://github.com/nodejs/node/pull/63055).

###### Other notable changes

* \[[`a2a4b33dd8`](https://github.com/nodejs/node/commit/a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`051a2152f7`](https://github.com/nodejs/node/commit/051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
* \[[`49462eca37`](https://github.com/nodejs/node/commit/49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](https://github.com/nodejs/node/pull/61597)
* \[[`97b7ab19bd`](https://github.com/nodejs/node/commit/97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](https://github.com/nodejs/node/pull/63079)
* \[[`cfb80a2103`](https://github.com/nodejs/node/commit/cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](https://github.com/nodejs/node/pull/62672)

###### Commits

* \[[`a2a4b33dd8`](https://github.com/nodejs/node/commit/a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`0eff3e23b9`](https://github.com/nodejs/node/commit/0eff3e23b9)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#63588](https://github.com/nodejs/node/pull/63588)
* \[[`447ab2d252`](https://github.com/nodejs/node/commit/447ab2d252)] - **build,win**: fix VS2022 arm64 PGO build (Stefan Stojanovic) [#63413](https://github.com/nodejs/node/pull/63413)
* \[[`86032758e4`](https://github.com/nodejs/node/commit/86032758e4)] - **build,win**: replace LTCG with Thin LTO for releases (Stefan Stojanovic) [#63114](https://github.com/nodejs/node/pull/63114)
* \[[`5f4d794052`](https://github.com/nodejs/node/commit/5f4d794052)] - **build,win**: add Rust toolchain automated configuration Windows (Mike McCready) [#63381](https://github.com/nodejs/node/pull/63381)
* \[[`051a2152f7`](https://github.com/nodejs/node/commit/051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
* \[[`d0f65e3579`](https://github.com/nodejs/node/commit/d0f65e3579)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#63531](https://github.com/nodejs/node/pull/63531)
* \[[`e3ddb326c9`](https://github.com/nodejs/node/commit/e3ddb326c9)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`e04cd17dc0`](https://github.com/nodejs/node/commit/e04cd17dc0)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`64ba74d847`](https://github.com/nodejs/node/commit/64ba74d847)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`bd230418b4`](https://github.com/nodejs/node/commit/bd230418b4)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`1a4090a83d`](https://github.com/nodejs/node/commit/1a4090a83d)] - **debugger**: surface inspector

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.3.0]_

### v26.2.0 — 2026-05-20, Version 26.2.0 (Current), @aduh95

- Date: 2026-05-20
- Version: v26.2.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.2.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.2.0

- **changed** — Mark stream.compose as stable
- **added** — Add Temporal.Instant support to Stats and BigIntStats
- **added** — Add writeInformation to http module to send arbitrary 1xx status codes
- **changed** — Align verifyOneShot accepted types in crypto
- **added** — Wire ML-DSA and ML-KEM for use when using BoringSSL
- **added** — Wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL
- **added** — Wire AES-KW in Web Cryptography when using BoringSSL
- **changed** — Improve system certificate enumeration logic on macOS
- **security** — Harden CryptoKey algorithm slots
- **security** — Harden KeyObject internal slots
- **fixed** — Reject invalid raw key imports
- **changed** — Improve accuracy of SubtleCrypto.supports
- **changed** — Optimize normalizeAlgorithm dispatch hot path
- **fixed** — Disambiguate probe location binding in debugger
- **added** — Add --help to node inspect and improve docs

###### Notable Changes

* \[[`189d43a193`](https://github.com/nodejs/node/commit/189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](https://github.com/nodejs/node/pull/62562)
* \[[`f858c6140e`](https://github.com/nodejs/node/commit/f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](https://github.com/nodejs/node/pull/60789)
* \[[`0cbb3895df`](https://github.com/nodejs/node/commit/0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](https://github.com/nodejs/node/pull/63155)

###### Commits

* \[[`9a394bab84`](https://github.com/nodejs/node/commit/9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](https://github.com/nodejs/node/pull/63314)
* \[[`ad98b4620b`](https://github.com/nodejs/node/commit/ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](https://github.com/nodejs/node/pull/63280)
* \[[`ba0736a847`](https://github.com/nodejs/node/commit/ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`5573a6a4a8`](https://github.com/nodejs/node/commit/5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`7dc563b8d6`](https://github.com/nodejs/node/commit/7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`b55e2b1f4d`](https://github.com/nodejs/node/commit/b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](https://github.com/nodejs/node/pull/62576)
* \[[`fd509a755a`](https://github.com/nodejs/node/commit/fd509a755a)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#63111](https://github.com/nodejs/node/pull/63111)
* \[[`8657df39e7`](https://github.com/nodejs/node/commit/8657df39e7)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#63111](https://github.com/nodejs/node/pull/63111)
* \[[`729274e046`](https://github.com/nodejs/node/commit/729274e046)] - **crypto**: reject invalid raw key imports (Filip Skokan) [#63134](https://github.com/nodejs/node/pull/63134)
* \[[`8fc9cb9c01`](https://github.com/nodejs/node/commit/8fc9cb9c01)] - **crypto**: improve accuracy of SubtleCrypto.supports (Filip Skokan) [#63104](https://github.com/nodejs/node/pull/63104)
* \[[`288065cb3f`](https://github.com/nodejs/node/commit/288065cb3f)] - **crypto**: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) [#62756](https://github.com/nodejs/node/pull/62756)
* \[[`ecf3797d09`](https://github.com/nodejs/node/commit/ecf3797d09)] - **debugger**: disambiguate probe location binding (Joyee Cheung) [#63286](https://github.com/nodejs/node/pull/63286)
* \[[`bdc57135fd`](https://github.com/nodejs/node/commit/bdc57135fd)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#63201](https://github.com/nodejs/node/pull/63201)
* \[[`2a6e6058e9`](https://github.com/nodejs/node/commit/2a6e6058e9)] - **deps**: update undici to 8.3.0 (Node.js GitHub Bot) [#63377](https://github.com/nodejs/node/pull/63377)
* \[[`327b927271`](https://github.com/nodejs/node/commit/327b927271)] - **deps**: update corepack to 0.35.0 (Node.js GitHub Bot) [#63375](https://github.com/nodejs/node/pull/63375)
* \[[`5828fadf52`](https://github.com/nodejs/node/commit/5828fadf52)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](https://github.com/nodejs/node/pull/63217)
* \[[`fe127a999b`](https://github.com/nodejs/node/commit/fe127a999b)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#62811](https://github.com/nodejs/node/pull/62811)
* \[[`a34c4ea159`](https://github.com/nodejs/node/commit/a34c4ea159)] - **deps*

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.2.0]_