Node.js changelog

Notable Changes Test runner module mocking improvements MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single option MockModuleOptions.exports to align with user expectations and other test

This is a security release. Notable Changes (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21711)

Notable Changes [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083 Commits [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033 [b26d1c7

Notable Changes [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343 [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298 [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for dia

Notable Changes [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713 [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813 [ee59127664] - sqlite: mark

Notable Changes [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 Commits [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 [a727054503] - deps: upgrade npm to 11.9.0 (

Notable Changes [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415 [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503 [dce657071e] - (SEMVER-MINOR) s

Notable Changes [99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419 [fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167 [0feab0f083] - (SEMVER-MINOR) deps: add tools and sc

Notable Changes [8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959 [bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [7930d7a19b] - crypto: update root certificates to NS

This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750 permission: (CVE-2026-21636) add network check on pipe_wrap connect (R

This release reverts the spec-compliant behavior of sometimes throwing on localStorage access. We received feedback that this change on an experimental API was too breaking for a semver-minor release, so we decided to push it back for Node.

Notable Changes [a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982 [4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351 [727560a96d] - (SEMVER-MINOR) module: mark typ

Notable Changes [4395fe14b9] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [2e55c6ad04] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217 [f437204491] - (SEMVER-MINOR) src:

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements, built-in Uint8Array base64/hex conversion, and ongoing WebAssembly and JIT pipeline optimizations. This release doubles down on secure-

Notable Changes [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674 [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390 [1fefdda18e] - crypto: update root certi

Notable Changes [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036 [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217 [d6ab039f24] - (SEMVER-MINOR

This is a security release. Notable Changes (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permissi

Notable Changes [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 [d3ef4122ee] - (SEMVER-MINOR) buffer: incre

This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48615) lib

Notable Changes [b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553 [ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713 [9705f628d9] - (SEMVER-M

Notable Changes [3d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #58708 [83c38672f7] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959 [54ef940e01] - (SEMVER-MINOR) crypto: add raw key formats suppo

This is a security release. Notable Changes (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21717)

Notable Changes [8b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415 [68da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 [f3a24c76e4] - (SEMVER-MINOR) de

Notable Changes [1f64d6841e] - build: add support for Python 3.14 (Christian Clauss) #59983 [30e500fc09] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [bc0a55f086] - crypto: update root certificates to NSS 3.119

This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797 (CVE-2025-55132) disable futimes when permission model is enabled (Raf

Notable Changes [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982 [8987159234] - (SEMVER-MINOR) modul

Notable Changes The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers has now been addressed and now returns uninitialized memory as documented in the Buffer.allocUnsafe documentation. Commits [0a15ccf3f4] - benchm

Notable Changes This release marks the transition of Node.js 24.x into Long Term Support (LTS) with the codename 'Krypton'. It will continue to receive updates through to the end of April 2028. Other than updating metadata, such as the proc

Notable Changes [31bb476895] - (SEMVER-MINOR) console: allow per-stream inspectOptions option (Anna Henningsen) #60082 [3b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #59980 [18c79d9e1c] - (SEMVER-MINOR) sqlite:

Notable Changes [9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824 [a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #58378

Notable Changes HTTP/2 Network Inspection Support in Node.js Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js. Usage Write a test.js script that makes HTTP/2 requests. const http2 = require('node:http2'

Notable Changes Post-Quantum Cryptography in node:crypto OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by allowing use of NIST's post-quantum cryptography standards for future-proofing applications against quan

Notable Changes [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 [201304537e] - (SEMVER-MINOR) zlib: add

This is a security release. Notable Changes (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permissi

This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0). Commits [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940 [eaa292549e] - http: avoid stream listene

This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48937) dep

Commits [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788 [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485 [e4c0d99839] - deps: update timez

This is a security release. Notable Changes (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21713)

Notable Changes [7b93a65f27] - build: test on Python 3.14 (Christian Clauss) #59983 [6063d888fe] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.j

This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (CVE-2025-55132) disable futimes when permission model is enabled lib,permission: (CVE-2025-55130) require full read and write to symlink

Commits [af33e8e668] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #59872 [6764ce8756] - benchmark: update count to n in permission startup (Bruno Rodrigues) #59872 [4e8d99f0dc] - benchmark: update num to n

Notable Changes [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #59151 [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165 [af8b5fa29d] - (SEMVER-MINOR) http:

Notable Changes OpenSSL updated to 3.5.2 For official Node.js builds, or builds using the default build configuration, Node.js now bundles OpenSSL 3.5.2. This update allows Node.js 22.x to be supported through to the planned End-of-Life dat

Notable Changes [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072 [cda1dab6e2] - (SEMVER-MINOR) crypto: ad

This is a security release. Notable Changes (CVE-2026-21717) fix array index hash collision (Joyee Cheung) (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) (CVE-2026-21710) use null prototype for

Notable Changes [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983 [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419 [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.

This is a security release. Notable Changes lib: (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802 (CVE-2025-59465) add TLSSocket default error handler (Raf

Notable Changes [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571 [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113 [db68cec4cb] - doc: deprecate HTTP/2 pri

Notable Changes [f5b293ad48] - doc: add JonasBa to collaborators (Jonas Badalic) #58355 [4e6ae787c6] - doc: add puskin to collaborators (Giovanni Bucci) #58308 [d06db658fc] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499 [3c6206cac9]