# Node.js changelog

> A JavaScript runtime built on Chrome's V8 engine.

- Vendor: OpenJS Foundation
- Category: Languages & Runtimes
- Official site: https://nodejs.org
- Tracked by: What's New (https://whatsnew.fyi/product/node-js)
- Harvested from: GitHub (nodejs/node)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v26.5.0 — 2026-07-08, Version 26.5.0 (Current), @richardlau

- Date: 2026-07-08
- Version: v26.5.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.5.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.5.0

- **added** — Implement blob.textStream() in buffer
- **added** — Add --experimental-import-text flag to esm
- **added** — Sample delay per event loop iteration in perf_hooks
- **added** — Expose ReadableStreamTee in stream
- **added** — Report negotiated TLS groups in tls
- **fixed** — Remove unreachable overflow check in buffer.atob()
- **added** — Add fast api for isUtf8 and isAscii in buffer
- **fixed** — Fix permission model propagation via NODE_OPTIONS in child_process
- **fixed** — Fix large DH generator validation in crypto
- **security** — Reject small-order EdDSA points during verify in crypto
- **fixed** — Skip dns.lookup() for literal IP addresses in dgram
- **fixed** — Return original thenable in diagnostics_channel

###### Notable Changes

###### New release key

Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.

###### Other notable changes

* \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
* \[[`b373202efc`](https://github.com/nodejs/node/commit/b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300)
* \[[`39e0c14455`](https://github.com/nodejs/node/commit/39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935)
* \[[`999a83c937`](https://github.com/nodejs/node/commit/999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195)
* \[[`4e0236dc3d`](https://github.com/nodejs/node/commit/4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119)

###### Commits

* \[[`87648c0a6c`](https://github.com/nodejs/node/commit/87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](https://github.com/nodejs/node/pull/64218)
* \[[`a483bfd3f0`](https://github.com/nodejs/node/commit/a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](https://github.com/nodejs/node/pull/60161)
* \[[`6d14279688`](https://github.com/nodejs/node/commit/6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](https://github.com/nodejs/node/pull/64169)
* \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
* \[[`a67d9a7a44`](https://github.com/nodejs/node/commit/a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#64157](https://github.com/nodejs/node/pull/64157)
* \[[`06c1fbc25b`](https://github.com/nodejs/node/commit/06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#62605](https://github.com/nodejs/node/pull/62605)
* \[[`518309c363`](https://github.com/nodejs/node/commit/518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#64222](https://github.com/nodejs/node/pull/64222)
* \[[`6a80ab485c`](https://github.com/nodejs/node/commit/6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#64118](https://github.com/nodejs/node/pull/64118)
* \[[`f4e7bf1f1c`](https://github.com/nodejs/node/commit/f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#64117](https://github.com/nodejs/node/pull/64117)
* \[[`66f6ac0d86`](https://github.com/nodejs/node/commit/66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#53899](https://github.com/nodejs/node/pull/53899)
* \[[`7f26c54aa6`](https://github.com/nodejs/node/commit/7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#63972](https://github.com/nodejs/node/pull/63972)
* \[[`32bb554f5b`](https://github.com/nodejs/node/commit/32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#64092](https://github.com/nodejs/node/pull/64092)
* \[[`0908d76ef6`](https://github.com/nodejs/node/commit/0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#64026](https://github.com/nodejs/node/pull/64026)
* \[[`7f7e5863c2`](https://github.com/nodejs/node/commit/7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#64282](https://github

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.5.0]_

### v26.4.0 — 2026-06-24, Version 26.4.0 (Current), @aduh95

- Date: 2026-06-24
- Version: v26.4.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.4.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.4.0

- **changed** — Update blockList stability status to release candidate
- **added** — Support caller-supplied buffers in fs.readFile()
- **added** — Close pre-request sockets in http.closeIdleConnections()
- **added** — Implement package maps in loader
- **added** — Support TCP_KEEPINTVL and TCP_KEEPCNT in net.setKeepAlive()
- **added** — Add certificateCompression option to tls
- **added** — Dispatch node:fs/promises to mounted VFS instances
- **added** — Add minimal node:vfs subsystem
- **changed** — Optimize Buffer.prototype.copy
- **changed** — Use simdutf for two-byte utf8 byteLength
- **changed** — Enable maglev by default on Linux ppc64le
- **changed** — Pass spawn options to the binding positionally in child_process
- **changed** — Serialize advanced IPC messages natively in child_process
- **added** — Support non-byte WebCrypto lengths and cSHAKE
- **changed** — Use EVP_MAC for HMAC on OpenSSL >=3
- **changed** — Make webcrypto aliasKeyFormat directional
- **fixed** — Fix unhandled error in Hash._transform
- **fixed** — Handle cipher context allocation failures

###### Notable Changes

* \[[`cde0daabcc`](https://github.com/nodejs/node/commit/cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](https://github.com/nodejs/node/pull/63050)
* \[[`b78f5a7537`](https://github.com/nodejs/node/commit/b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](https://github.com/nodejs/node/pull/63634)
* \[[`417aacbc36`](https://github.com/nodejs/node/commit/417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](https://github.com/nodejs/node/pull/63470)
* \[[`fbb108be7d`](https://github.com/nodejs/node/commit/fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](https://github.com/nodejs/node/pull/62239)
* \[[`45494d5a8a`](https://github.com/nodejs/node/commit/45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](https://github.com/nodejs/node/pull/63825)
* \[[`ee29465e77`](https://github.com/nodejs/node/commit/ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217)
* \[[`b17817eb2b`](https://github.com/nodejs/node/commit/b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](https://github.com/nodejs/node/pull/63537)
* \[[`7bc93a6ac5`](https://github.com/nodejs/node/commit/7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](https://github.com/nodejs/node/pull/63115)

###### Commits

* \[[`c7eb83b46a`](https://github.com/nodejs/node/commit/c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](https://github.com/nodejs/node/pull/63929)
* \[[`066fff17a5`](https://github.com/nodejs/node/commit/066fff17a5)] - **benchmark**: remove old alias usage in ffi benchmarks (Anna Henningsen) [#63666](https://github.com/nodejs/node/pull/63666)
* \[[`509cd1b94f`](https://github.com/nodejs/node/commit/509cd1b94f)] - **buffer**: optimize Buffer.prototype.copy (Robert Nagy) [#63828](https://github.com/nodejs/node/pull/63828)
* \[[`86e651bbd0`](https://github.com/nodejs/node/commit/86e651bbd0)] - **buffer**: use simdutf for two-byte utf8 byteLength (Mert Can Altin) [#63639](https://github.com/nodejs/node/pull/63639)
* \[[`d3f4ed9015`](https://github.com/nodejs/node/commit/d3f4ed9015)] - **build**: suppress compiler warnings for histogram (Richard Lau) [#63980](https://github.com/nodejs/node/pull/63980)
* \[[`82dd7ddbe6`](https://github.com/nodejs/node/commit/82dd7ddbe6)] - **build**: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) [#63875](https://github.com/nodejs/node/pull/63875)
* \[[`1124c0652d`](https://github.com/nodejs/node/commit/1124c0652d)] - **build**: remove redundant intermediate node\_aix\_shared (Chengzhong Wu) [#63747](https://github.com/nodejs/node/pull/63747)
* \[[`e510ee8087`](https://github.com/nodejs/node/commit/e510ee8087)] - **build**: build codecache and snapshot with libnode (Chengzhong Wu) [#63626](https://github.com/nodejs/node/pull/63626)
* \[[`5b583dace5`](https://github.com/nodejs/node/commit/5b583dace5)] - **build**: enable maglev by default on Linux ppc64le (Richard Lau) [#63474](https://github.com/nodejs/node/pull/63474)
* \[[`a2324246b4`](https://github.com/nodejs/node/commit/a2324246b4)] - **build**: remove duplicated node\_use\_sqlite and node\_use\_ffi conditions (Chengzhong Wu) [#63629](https://github.com/nodejs/node/pull/63629)
* \[[`2a467a5f69`](https://github.com/nodejs/node/commit/2a467a5f69)] - _**Revert**_ "**build, doc**: generate node.1 with doc-kit" (Antoine du Hamel) [#64091](https://github.com/nodejs/node/pull/64091)
* \[[`e01dec45b8`](https://github.com/nodejs/node/commit/e01dec45b8)] - **build, doc**: generate node.1

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.4.0]_

### v24.18.0 — 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa

- Date: 2026-06-23
- Version: v24.18.0
- Original notes: https://github.com/nodejs/node/releases/tag/v24.18.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v24.18.0

- **changed** — Update root certificates to NSS 3.123.1
- **fixed** — Avoid stream listeners on idle agent sockets in http
- **added** — Increase Buffer.poolSize default to 64 KiB
- **changed** — Align key argument names in crypto docs and error messages
- **added** — Accept key data in crypto.diffieHellman() and cleanup DH jobs
- **added** — Add TurboSHAKE and KangarooTwelve Web Cryptography algorithms
- **added** — Add writeInformation to http for sending arbitrary 1xx status codes
- **added** — Expose precise coverage start to JS runtime in inspector
- **fixed** — Revert noop pause/resume on destroyed streams

###### Notable Changes

* \[[`e07e7a31e1`](https://github.com/nodejs/node/commit/e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
* \[[`44c8ebcbd6`](https://github.com/nodejs/node/commit/44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#64004](https://github.com/nodejs/node/pull/64004)
* \[[`d3ef4122ee`](https://github.com/nodejs/node/commit/d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`bb2857b85a`](https://github.com/nodejs/node/commit/bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#62527](https://github.com/nodejs/node/pull/62527)
* \[[`b9d5e87880`](https://github.com/nodejs/node/commit/b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#62527](https://github.com/nodejs/node/pull/62527)
* \[[`ccd756d61e`](https://github.com/nodejs/node/commit/ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#62183](https://github.com/nodejs/node/pull/62183)
* \[[`4c9251fc09`](https://github.com/nodejs/node/commit/4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#63155](https://github.com/nodejs/node/pull/63155)
* \[[`8c989ec4a3`](https://github.com/nodejs/node/commit/8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](https://github.com/nodejs/node/pull/63079)
* \[[`3f54c8ba32`](https://github.com/nodejs/node/commit/3f54c8ba32)] - _**Revert**_ "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#63834](https://github.com/nodejs/node/pull/63834)

###### Commits

* \[[`d3ef4122ee`](https://github.com/nodejs/node/commit/d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`9ff36e40f0`](https://github.com/nodejs/node/commit/9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#62755](https://github.com/nodejs/node/pull/62755)
* \[[`7c22ee23aa`](https://github.com/nodejs/node/commit/7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#63588](https://github.com/nodejs/node/pull/63588)
* \[[`2551abdb4a`](https://github.com/nodejs/node/commit/2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#62761](https://github.com/nodejs/node/pull/62761)
* \[[`e8a55ce9b1`](https://github.com/nodejs/node/commit/e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#62763](https://github.com/nodejs/node/pull/62763)
* \[[`ae61cd68f3`](https://github.com/nodejs/node/commit/ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`3d05a1d396`](https://github.com/nodejs/node/commit/3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`f9d10a3f6b`](https://github.com/nodejs/node/commit/f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`e431d93e9e`](https://github.com/nodejs/node/commit/e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`56e2505e48`](https://github.com/nodejs/node/commit/56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`3bac77f2a8`](https://github.com/nodejs/node/commit/3

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v24.18.0]_

### v22.23.1 — 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSS

- Date: 2026-06-23
- Version: v22.23.1
- Original notes: https://github.com/nodejs/node/releases/tag/v22.23.1
- Permalink: https://whatsnew.fyi/product/node-js/releases/v22.23.1

- **fixed** — Avoid stream listeners on idle agent sockets in http module

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

###### Commits

* \[[`41d2ee13be`](https://github.com/nodejs/node/commit/41d2ee13be)] - **build**: switch coverage-windows to `windows-2022` (Richard Lau) [#63940](https://github.com/nodejs/node/pull/63940)
* \[[`eaa292549e`](https://github.com/nodejs/node/commit/eaa292549e)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#64004](https://github.com/nodejs/node/pull/64004)

### v26.3.1 — 2026-06-18, Version 26.3.1 (Current), @aduh95

- Date: 2026-06-18
- Version: v26.3.1
- Original notes: https://github.com/nodejs/node/releases/tag/v26.3.1
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.3.1

- **security** — Normalize hostname for server identity checks in tls (CVE-2026-48618)
- **security** — Guard WebCrypto cipher output length in crypto (CVE-2026-48933)
- **security** — Redact proxy credentials in tunnel errors (CVE-2026-48615)
- **security** — Cap originSet size to prevent unbounded memory growth in http2 (CVE-2026-48619)
- **security** — Fix case-sensitive SNI context matching in tls (CVE-2026-48928)
- **security** — Reject hostnames with embedded NUL bytes in dns and net (CVE-2026-48930)
- **security** — Bind reusable sessions to authenticated host in tls (CVE-2026-48934)
- **security** — Handle process.chdir on writereport in permission (CVE-2026-48617)
- **security** — Fix response queue poisoning in http.Agent (CVE-2026-48931)
- **security** — Disable FileHandle utimes with permission model (CVE-2026-48935)
- **security** — Guard pipe open and chmod with net scope in permission (CVE-2026-48936)

This is a security release.

###### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

###### Commits

* \[[`98fbc89211`](https://github.com/nodejs/node/commit/98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`110840f2c7`](https://github.com/nodejs/node/commit/110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`8d36d522b2`](https://github.com/nodejs/node/commit/8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](https://github.com/nodejs/node/pull/63903)
* \[[`2e6d03993a`](https://github.com/nodejs/node/commit/2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](https://github.com/nodejs/node/pull/63779)
* \[[`5a17d5b07a`](https://github.com/nodejs/node/commit/5a17d5b07a)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`362725d4e5`](https://github.com/nodejs/node/commit/362725d4e5)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`bd1214ab01`](https://github.com/nodejs/node/commit/bd1214ab01)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
* \[[`bc0b53813e`](https://github.com/nodejs/node/commit/bc0b53813e)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
* \[[`87d847bc70`](https://github.com/nodejs/node/commit/87d847bc70)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
* \[[`9308084fcb`](https://github.com/nodejs/node/commit/9308084fcb)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
* \[[`a67dd46891`](https://github.com/nodejs/node/commit/a67dd46891)] - **(CVE-2026-48936)** **permission**: guard pipe open and chmod with net scope (RafaelGSS) [nodejs-private/node-private#885](https://github.com/nodejs-private/node-private/pull/885)
* \[[`7057c3f16c`](https://github.com/nodejs/node/commit/7057c3f16c)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
* \[[`6bc17a6b51`](https://github.com/nodejs/node/commit/6bc17a6b51)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (Rafael

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.3.1]_

### v24.17.0 — 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95

- Date: 2026-06-18
- Version: v24.17.0
- Original notes: https://github.com/nodejs/node/releases/tag/v24.17.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v24.17.0

- **security** — Normalize hostname for server identity checks in tls
- **security** — Guard WebCrypto cipher output length in crypto
- **security** — Redact proxy credentials in tunnel errors
- **security** — Cap originSet size in http2 to prevent unbounded memory growth
- **security** — Fix case-sensitive SNI context matching in tls
- **security** — Reject hostnames with embedded NUL bytes in dns and net
- **security** — Bind reusable sessions to authenticated host in tls
- **security** — Fix integration issues with the latest nghttp2
- **security** — Handle process.chdir on writereport in permission
- **security** — Fix response queue poisoning in http.Agent
- **security** — Disable FileHandle utimes with permission model

This is a security release.

###### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

###### Commits

* \[[`9e4dfc7bba`](https://github.com/nodejs/node/commit/9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`cb2aed980c`](https://github.com/nodejs/node/commit/cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`a8a0d12875`](https://github.com/nodejs/node/commit/a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#62891](https://github.com/nodejs/node/pull/62891)
* \[[`66e6203c1c`](https://github.com/nodejs/node/commit/66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#62891](https://github.com/nodejs/node/pull/62891)
* \[[`dd627ced27`](https://github.com/nodejs/node/commit/dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`684bae568f`](https://github.com/nodejs/node/commit/684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`3a631e7f83`](https://github.com/nodejs/node/commit/3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#62656](https://github.com/nodejs/node/pull/62656)
* \[[`cf44df3996`](https://github.com/nodejs/node/commit/cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#63703](https://github.com/nodejs/node/pull/63703)
* \[[`138c70294b`](https://github.com/nodejs/node/commit/138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
* \[[`be7e719c3f`](https://github.com/nodejs/node/commit/be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
* \[[`cc7c11b4d1`](https://github.com/nodejs/node/commit/cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
* \[[`9224427b92`](https://github.com/nodejs/node/commit/9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
* \[[`cf85d54839`](https://github.com/nodejs/node/commit/cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-priv

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v24.17.0]_

### v22.23.0 — 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95

- Date: 2026-06-18
- Version: v22.23.0
- Original notes: https://github.com/nodejs/node/releases/tag/v22.23.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v22.23.0

- **security** — Normalize hostname for server identity checks in tls
- **security** — Guard WebCrypto cipher output length in crypto
- **security** — Fix integration issues with the latest nghttp2 in deps
- **security** — Reject hostnames with embedded NUL bytes in dns and net
- **security** — Cap originSet size to prevent unbounded memory growth in http2
- **security** — Redact proxy credentials in tunnel errors in lib and test
- **security** — Bind reusable sessions to authenticated host in tls
- **security** — Fix case-sensitive SNI context matching in tls
- **security** — Handle process.chdir on writereport in permission
- **security** — Fix response queue poisoning in http.Agent in http
- **security** — Disable FileHandle utimes with permission model in permission
- **changed** — Update llhttp to 9.4.2
- **changed** — Update undici to 6.27.0
- **changed** — Update nghttp2 to 1.69.0
- **changed** — Update openssl sources to openssl-3.5.7
- **removed** — Remove support for priority signaling in http2

This is a security release.

###### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

###### Commits

* \[[`38b4c5ed51`](https://github.com/nodejs/node/commit/38b4c5ed51)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`ad8a10c1bb`](https://github.com/nodejs/node/commit/ad8a10c1bb)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`ca825a87cc`](https://github.com/nodejs/node/commit/ca825a87cc)] - **deps**: update undici to 6.27.0 (aduh95) [#63711](https://github.com/nodejs/node/pull/63711)
* \[[`a1a5bb9683`](https://github.com/nodejs/node/commit/a1a5bb9683)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#62891](https://github.com/nodejs/node/pull/62891)
* \[[`0f48583512`](https://github.com/nodejs/node/commit/0f48583512)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#62891](https://github.com/nodejs/node/pull/62891)
* \[[`38c869fc05`](https://github.com/nodejs/node/commit/38c869fc05)] - **deps**: update nghttp2 to 1.68.0 (nodejs-github-bot) [#61136](https://github.com/nodejs/node/pull/61136)
* \[[`290667c84f`](https://github.com/nodejs/node/commit/290667c84f)] - **deps**: update nghttp2 to 1.67.1 (nodejs-github-bot) [#59790](https://github.com/nodejs/node/pull/59790)
* \[[`c9f3da76aa`](https://github.com/nodejs/node/commit/c9f3da76aa)] - **deps**: update nghttp2 to 1.66.0 (Node.js GitHub Bot) [#58786](https://github.com/nodejs/node/pull/58786)
* \[[`60890be563`](https://github.com/nodejs/node/commit/60890be563)] - **deps**: update nghttp2 to 1.65.0 (Node.js GitHub Bot) [#57269](https://github.com/nodejs/node/pull/57269)
* \[[`5024c7d5d8`](https://github.com/nodejs/node/commit/5024c7d5d8)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`7f4eb5af2e`](https://github.com/nodejs/node/commit/7f4eb5af2e)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#63820](https://github.com/nodejs/node/pull/63820)
* \[[`ebb4ec78a8`](https://github.com/nodejs/node/commit/ebb4ec78a8)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#62656](https://github.com/nodejs/node/pull/62656)
* \[[`5763d40826`](https://github.com/nodejs/node/commit/5763d40826)] - **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot) [#63045](https://github.com/nodejs/node/pull/63045)
* \[[`c551a51d0c`](https://github.com/nodejs/node/commit/c551a51d0c)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
* \[[`0a22d40180`](https://github.com/nodejs/node/commit/0a22d40180)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v22.23.0]_

### v26.3.0 — 2026-06-01, Version 26.3.0 (Current), @aduh95

- Date: 2026-06-01
- Version: v26.3.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.3.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.3.0

- **changed** — Increase Buffer.poolSize default to 64 KiB
- **changed** — Update root certificates to NSS 3.123.1
- **added** — Add httpValidation option to configure header value validation
- **added** — Expose precise coverage start to JS runtime in inspector
- **added** — Add permission.drop to permission system
- **fixed** — Coerce -0 keylen to +0 in pbkdf2 and scrypt
- **security** — Harden WebCrypto against prototype pollution
- **changed** — Remove async from WebCrypto methods
- **fixed** — Surface inspector failures in probe mode in debugger

###### Notable Changes

###### Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in [#63055](https://github.com/nodejs/node/pull/63055).

###### Other notable changes

* \[[`a2a4b33dd8`](https://github.com/nodejs/node/commit/a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`051a2152f7`](https://github.com/nodejs/node/commit/051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
* \[[`49462eca37`](https://github.com/nodejs/node/commit/49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](https://github.com/nodejs/node/pull/61597)
* \[[`97b7ab19bd`](https://github.com/nodejs/node/commit/97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](https://github.com/nodejs/node/pull/63079)
* \[[`cfb80a2103`](https://github.com/nodejs/node/commit/cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](https://github.com/nodejs/node/pull/62672)

###### Commits

* \[[`a2a4b33dd8`](https://github.com/nodejs/node/commit/a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](https://github.com/nodejs/node/pull/63597)
* \[[`0eff3e23b9`](https://github.com/nodejs/node/commit/0eff3e23b9)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#63588](https://github.com/nodejs/node/pull/63588)
* \[[`447ab2d252`](https://github.com/nodejs/node/commit/447ab2d252)] - **build,win**: fix VS2022 arm64 PGO build (Stefan Stojanovic) [#63413](https://github.com/nodejs/node/pull/63413)
* \[[`86032758e4`](https://github.com/nodejs/node/commit/86032758e4)] - **build,win**: replace LTCG with Thin LTO for releases (Stefan Stojanovic) [#63114](https://github.com/nodejs/node/pull/63114)
* \[[`5f4d794052`](https://github.com/nodejs/node/commit/5f4d794052)] - **build,win**: add Rust toolchain automated configuration Windows (Mike McCready) [#63381](https://github.com/nodejs/node/pull/63381)
* \[[`051a2152f7`](https://github.com/nodejs/node/commit/051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](https://github.com/nodejs/node/pull/63527)
* \[[`d0f65e3579`](https://github.com/nodejs/node/commit/d0f65e3579)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#63531](https://github.com/nodejs/node/pull/63531)
* \[[`e3ddb326c9`](https://github.com/nodejs/node/commit/e3ddb326c9)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`e04cd17dc0`](https://github.com/nodejs/node/commit/e04cd17dc0)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`64ba74d847`](https://github.com/nodejs/node/commit/64ba74d847)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`bd230418b4`](https://github.com/nodejs/node/commit/bd230418b4)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#63363](https://github.com/nodejs/node/pull/63363)
* \[[`1a4090a83d`](https://github.com/nodejs/node/commit/1a4090a83d)] - **debugger**: surface inspector

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.3.0]_

### v24.16.0 — 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95

- Date: 2026-05-21
- Version: v24.16.0
- Original notes: https://github.com/nodejs/node/releases/tag/v24.16.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v24.16.0

- **added** — Implement randomUUIDv7() in crypto module
- **added** — Add edit-free runtime expression probes to node inspect debugger
- **added** — Add signal option to fs.stat()
- **added** — Expose frsize field in statfs
- **added** — Add req.signal to IncomingMessage
- **added** — Support test order randomization in test runner
- **added** — Add mock-timers support for AbortSignal.timeout in test runner
- **added** — Colorize text with hex colors in util
- **changed** — Harden ClientRequest options merge in http module
- **changed** — Propagate destruction in duplexPair in stream module
- **changed** — Align mock timeout api in test runner
- **fixed** — Fix stale nested cycle memo entries in assert and util
- **fixed** — Deduplicate and canonicalize CryptoKey usages
- **fixed** — Reject unintended raw key format string input in crypto
- **fixed** — Remove Argon2 KDF derivation from its job setup in crypto
- **fixed** — Fix unsigned conversion of 4-byte RSA publicExponent in crypto
- **fixed** — Reject inherited key type names in crypto
- **fixed** — Add memory tracking for secureContext openssl objects in crypto
- **fixed** — Add support for Ed25519 context parameter in crypto

###### Notable Changes

* \[[`b267f6bca3`](https://github.com/nodejs/node/commit/b267f6bca3)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](https://github.com/nodejs/node/pull/62553)
* \[[`ec2451b9cd`](https://github.com/nodejs/node/commit/ec2451b9cd)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](https://github.com/nodejs/node/pull/62713)
* \[[`9705f628d9`](https://github.com/nodejs/node/commit/9705f628d9)] - **(SEMVER-MINOR)** **fs**: add signal option to `fs.stat()` (Mert Can Altin) [#57775](https://github.com/nodejs/node/pull/57775)
* \[[`40ccfdecf9`](https://github.com/nodejs/node/commit/40ccfdecf9)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](https://github.com/nodejs/node/pull/62277)
* \[[`d7188af5c9`](https://github.com/nodejs/node/commit/d7188af5c9)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#63082](https://github.com/nodejs/node/pull/63082)
* \[[`aa1d8a9afc`](https://github.com/nodejs/node/commit/aa1d8a9afc)] - **(SEMVER-MINOR)** **http**: add `req.signal` to `IncomingMessage` (Akshat) [#62541](https://github.com/nodejs/node/pull/62541)
* \[[`6f37f7e240`](https://github.com/nodejs/node/commit/6f37f7e240)] - **(SEMVER-MINOR)** **stream**: propagate destruction in `duplexPair` (Ahmed Elhor) [#61098](https://github.com/nodejs/node/pull/61098)
* \[[`d14029be7f`](https://github.com/nodejs/node/commit/d14029be7f)] - **(SEMVER-MINOR)** **test\_runner**: support test order randomization (Pietro Marchini) [#61747](https://github.com/nodejs/node/pull/61747)
* \[[`d142c584cd`](https://github.com/nodejs/node/commit/d142c584cd)] - **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook) [#62820](https://github.com/nodejs/node/pull/62820)
* \[[`01a9552585`](https://github.com/nodejs/node/commit/01a9552585)] - **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) [#60751](https://github.com/nodejs/node/pull/60751)
* \[[`00705a459a`](https://github.com/nodejs/node/commit/00705a459a)] - **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme Araújo) [#61556](https://github.com/nodejs/node/pull/61556)

###### Commits

* \[[`dd72df060d`](https://github.com/nodejs/node/commit/dd72df060d)] - **assert,util**: fix stale nested cycle memo entries (Ruben Bridgewater) [#62509](https://github.com/nodejs/node/pull/62509)
* \[[`add94f4bc3`](https://github.com/nodejs/node/commit/add94f4bc3)] - **build**: track PDL files as inputs in inspector GN build (Robo) [#62888](https://github.com/nodejs/node/pull/62888)
* \[[`1b1eb9e334`](https://github.com/nodejs/node/commit/1b1eb9e334)] - **build**: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) [#62667](https://github.com/nodejs/node/pull/62667)
* \[[`8752b604ec`](https://github.com/nodejs/node/commit/8752b604ec)] - **crypto**: deduplicate and canonicalize CryptoKey usages (Filip Skokan) [#62902](https://github.com/nodejs/node/pull/62902)
* \[[`341947e7fd`](https://github.com/nodejs/node/commit/341947e7fd)] - **crypto**: reject unintended raw key format string input (Filip Skokan) [#62974](https://github.com/nodejs/node/pull/62974)
* \[[`28a78747fc`](https://github.com/nodejs/node/commit/28a78747fc)] - **crypto**: remove Argon2 KDF derivation from its job setup (Filip Skokan) [#62863](https://github.com/nodejs/node/pull/62863)
* \[[`16e8c2b54d`](https://github.com/nodejs/node/commit/16e8c2b54d)] - **crypto**: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) [#62839](https://github.com/nodejs/node/pull/62839)
* \[[`eeae754a87`](https://github.com/nodejs/node/commit/eeae754a87)] - **crypto**: reject inherited key type names (Jonathan Lopes) [#62875](https://github.com/nodejs/node/pull/62875)
* \[[`9dd5540325`](https://github.com/nodejs/node/commit/9dd5540325)] - **crypto**: add memory tracking fo

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v24.16.0]_

### v26.2.0 — 2026-05-20, Version 26.2.0 (Current), @aduh95

- Date: 2026-05-20
- Version: v26.2.0
- Original notes: https://github.com/nodejs/node/releases/tag/v26.2.0
- Permalink: https://whatsnew.fyi/product/node-js/releases/v26.2.0

- **changed** — Mark stream.compose as stable
- **added** — Add Temporal.Instant support to Stats and BigIntStats
- **added** — Add writeInformation to http module to send arbitrary 1xx status codes
- **changed** — Align verifyOneShot accepted types in crypto
- **added** — Wire ML-DSA and ML-KEM for use when using BoringSSL
- **added** — Wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL
- **added** — Wire AES-KW in Web Cryptography when using BoringSSL
- **changed** — Improve system certificate enumeration logic on macOS
- **security** — Harden CryptoKey algorithm slots
- **security** — Harden KeyObject internal slots
- **fixed** — Reject invalid raw key imports
- **changed** — Improve accuracy of SubtleCrypto.supports
- **changed** — Optimize normalizeAlgorithm dispatch hot path
- **fixed** — Disambiguate probe location binding in debugger
- **added** — Add --help to node inspect and improve docs

###### Notable Changes

* \[[`189d43a193`](https://github.com/nodejs/node/commit/189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](https://github.com/nodejs/node/pull/62562)
* \[[`f858c6140e`](https://github.com/nodejs/node/commit/f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](https://github.com/nodejs/node/pull/60789)
* \[[`0cbb3895df`](https://github.com/nodejs/node/commit/0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](https://github.com/nodejs/node/pull/63155)

###### Commits

* \[[`9a394bab84`](https://github.com/nodejs/node/commit/9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](https://github.com/nodejs/node/pull/63314)
* \[[`ad98b4620b`](https://github.com/nodejs/node/commit/ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](https://github.com/nodejs/node/pull/63280)
* \[[`ba0736a847`](https://github.com/nodejs/node/commit/ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`5573a6a4a8`](https://github.com/nodejs/node/commit/5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`7dc563b8d6`](https://github.com/nodejs/node/commit/7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](https://github.com/nodejs/node/pull/63255)
* \[[`b55e2b1f4d`](https://github.com/nodejs/node/commit/b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](https://github.com/nodejs/node/pull/62576)
* \[[`fd509a755a`](https://github.com/nodejs/node/commit/fd509a755a)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#63111](https://github.com/nodejs/node/pull/63111)
* \[[`8657df39e7`](https://github.com/nodejs/node/commit/8657df39e7)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#63111](https://github.com/nodejs/node/pull/63111)
* \[[`729274e046`](https://github.com/nodejs/node/commit/729274e046)] - **crypto**: reject invalid raw key imports (Filip Skokan) [#63134](https://github.com/nodejs/node/pull/63134)
* \[[`8fc9cb9c01`](https://github.com/nodejs/node/commit/8fc9cb9c01)] - **crypto**: improve accuracy of SubtleCrypto.supports (Filip Skokan) [#63104](https://github.com/nodejs/node/pull/63104)
* \[[`288065cb3f`](https://github.com/nodejs/node/commit/288065cb3f)] - **crypto**: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) [#62756](https://github.com/nodejs/node/pull/62756)
* \[[`ecf3797d09`](https://github.com/nodejs/node/commit/ecf3797d09)] - **debugger**: disambiguate probe location binding (Joyee Cheung) [#63286](https://github.com/nodejs/node/pull/63286)
* \[[`bdc57135fd`](https://github.com/nodejs/node/commit/bdc57135fd)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#63201](https://github.com/nodejs/node/pull/63201)
* \[[`2a6e6058e9`](https://github.com/nodejs/node/commit/2a6e6058e9)] - **deps**: update undici to 8.3.0 (Node.js GitHub Bot) [#63377](https://github.com/nodejs/node/pull/63377)
* \[[`327b927271`](https://github.com/nodejs/node/commit/327b927271)] - **deps**: update corepack to 0.35.0 (Node.js GitHub Bot) [#63375](https://github.com/nodejs/node/pull/63375)
* \[[`5828fadf52`](https://github.com/nodejs/node/commit/5828fadf52)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](https://github.com/nodejs/node/pull/63217)
* \[[`fe127a999b`](https://github.com/nodejs/node/commit/fe127a999b)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#62811](https://github.com/nodejs/node/pull/62811)
* \[[`a34c4ea159`](https://github.com/nodejs/node/commit/a34c4ea159)] - **deps*

_[Truncated at 4000 characters — full notes: https://github.com/nodejs/node/releases/tag/v26.2.0]_