Commits [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel) [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel) [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 upda
Catalog / Runtimes
Node.js changelog
Node.js is at 26.11.1, published 7 Oct 2026, 4 days ago.
JavaScript runtime built on V8, with long term support lines and security releases.
SubscribeNode.js as markdown, for pasting into a model
- Collected
- 68 releases back to 14 Aug 2025
- Source
- nodejs/node
- Project
- nodejs.org
- Feed
- RSS
Every release of a major line in one list, which is the one view the publisher never writes: 24 to 25, 25 to 26. Only the lines whose first release the archive holds are listed, because a partial major would read as the whole of one.
Read on 28 of the 30 days on record, last today. Collection status
Version history
26.x17 releases
Notable Changes [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298 [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064 [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #620
Notable Changes [c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090 [64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a
Notable Changes [d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553 [7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484 [7c7e95a3bd] - (SEMVER-MINOR) crypto: disc
Notable Changes [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593 [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438 [09feba74c8] - deps: update
Notable Changes Out-of-band release to fix node --version which was reporting an alpha version. Commits [ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #65568 [0b0dd87fcc] - tools: fix tools/nix/list-requisites.sh
Notable Changes [74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416 [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [f0531f1c87] - (SEMVER-MINOR) crypto:
Notable Changes [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949 [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [c1e4f7365e] - (SEMVER-M
Notable Changes [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656 [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323 [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and tes
This is a security release. Notable Changes (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High (CVE-2026-56850) https: distinguish
Notable Changes New release key Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD. Other notable changes [55f48446c7] - (SEMVER-MINOR) buf
Notable Changes [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050 [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634 [417aacb
This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48615) lib
Notable Changes Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain
Notable Changes [189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562 [f858c6140e] - (SEMVER-MINOR) fs: add Temporal.Instant support to Stats and BigIntStats (Livia Medeiros) #60789 [0cbb3895df] - (SEMVER-MINOR) http: add w
Notable Changes Experimental node:ffi module Node.js now includes an experimental node:ffi module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the --experimental-ffi flag and, when the Pe
We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to moder
25.x14 releases
Notable Changes Test runner module mocking improvements MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single option MockModuleOptions.exports to align with user expectations and other test
This is a security release. Notable Changes (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21711)
Notable Changes [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083 Commits [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033 [b26d1c7
Notable Changes [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343 [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298 [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for dia
Notable Changes [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713 [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813 [ee59127664] - sqlite: mark
Notable Changes [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 Commits [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 [a727054503] - deps: upgrade npm to 11.9.0 (
Notable Changes [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415 [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503 [dce657071e] - (SEMVER-MINOR) s
Notable Changes [99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419 [fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167 [0feab0f083] - (SEMVER-MINOR) deps: add tools and sc
Notable Changes [8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959 [bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [7930d7a19b] - crypto: update root certificates to NS
This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750 permission: (CVE-2026-21636) add network check on pipe_wrap connect (R
This release reverts the spec-compliant behavior of sometimes throwing on localStorage access. We received feedback that this change on an experimental API was too breaking for a semver-minor release, so we decided to push it back for Node.
Notable Changes [a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982 [4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351 [727560a96d] - (SEMVER-MINOR) module: mark typ
Notable Changes [4395fe14b9] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [2e55c6ad04] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217 [f437204491] - (SEMVER-MINOR) src:
Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements, built-in Uint8Array base64/hex conversion, and ongoing WebAssembly and JIT pipeline optimizations. This release doubles down on secure-
24.x20 releases
Notable Changes [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949 [6274fccbd9] - deps: upd
Notable Changes [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674 [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390 [1fefdda18e] - crypto: update root certi
Notable Changes [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036 [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217 [d6ab039f24] - (SEMVER-MINOR
This is a security release. Notable Changes (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permissi
Notable Changes [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 [d3ef4122ee] - (SEMVER-MINOR) buffer: incre
This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48615) lib
Notable Changes [b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553 [ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713 [9705f628d9] - (SEMVER-M
Notable Changes [3d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #58708 [83c38672f7] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959 [54ef940e01] - (SEMVER-MINOR) crypto: add raw key formats suppo
This is a security release. Notable Changes (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21717)
Notable Changes [8b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415 [68da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 [f3a24c76e4] - (SEMVER-MINOR) de
Notable Changes [1f64d6841e] - build: add support for Python 3.14 (Christian Clauss) #59983 [30e500fc09] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [bc0a55f086] - crypto: update root certificates to NSS 3.119
This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797 (CVE-2025-55132) disable futimes when permission model is enabled (Raf
Notable Changes [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982 [8987159234] - (SEMVER-MINOR) modul
Notable Changes The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers has now been addressed and now returns uninitialized memory as documented in the Buffer.allocUnsafe documentation. Commits [0a15ccf3f4] - benchm
Notable Changes This release marks the transition of Node.js 24.x into Long Term Support (LTS) with the codename 'Krypton'. It will continue to receive updates through to the end of April 2028. Other than updating metadata, such as the proc
Notable Changes [31bb476895] - (SEMVER-MINOR) console: allow per-stream inspectOptions option (Anna Henningsen) #60082 [3b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #59980 [18c79d9e1c] - (SEMVER-MINOR) sqlite:
Notable Changes [9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824 [a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #58378
Notable Changes HTTP/2 Network Inspection Support in Node.js Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js. Usage Write a test.js script that makes HTTP/2 requests. const http2 = require('node:http2'
Notable Changes Post-Quantum Cryptography in node:crypto OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by allowing use of NIST's post-quantum cryptography standards for future-proofing applications against quan
Notable Changes [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 [201304537e] - (SEMVER-MINOR) zlib: add
22.x12 releases
Notable Changes [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746 [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653 [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
This is a security release. Notable Changes (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High (CVE-2026-58043) permissi
This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0). Commits [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940 [eaa292549e] - http: avoid stream listene
This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48937) dep
Commits [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788 [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485 [e4c0d99839] - deps: update timez
This is a security release. Notable Changes (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21713)
Notable Changes [7b93a65f27] - build: test on Python 3.14 (Christian Clauss) #59983 [6063d888fe] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.j
This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (CVE-2025-55132) disable futimes when permission model is enabled lib,permission: (CVE-2025-55130) require full read and write to symlink
Commits [af33e8e668] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #59872 [6764ce8756] - benchmark: update count to n in permission startup (Bruno Rodrigues) #59872 [4e8d99f0dc] - benchmark: update num to n
Notable Changes [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #59151 [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165 [af8b5fa29d] - (SEMVER-MINOR) http:
Notable Changes OpenSSL updated to 3.5.2 For official Node.js builds, or builds using the default build configuration, Node.js now bundles OpenSSL 3.5.2. This update allows Node.js 22.x to be supported through to the planned End-of-Life dat
Notable Changes [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072 [cda1dab6e2] - (SEMVER-MINOR) crypto: ad
20.x5 releases
This is a security release. Notable Changes (CVE-2026-21717) fix array index hash collision (Joyee Cheung) (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) (CVE-2026-21710) use null prototype for
Notable Changes [91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983 [f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419 [80feacaddb] - crypto: update root certificates to NSS 3.117 (Node.
This is a security release. Notable Changes lib: (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802 (CVE-2025-59465) add TLSSocket default error handler (Raf
Notable Changes [6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571 [082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113 [db68cec4cb] - doc: deprecate HTTP/2 pri
Notable Changes [f5b293ad48] - doc: add JonasBa to collaborators (Jonas Badalic) #58355 [4e6ae787c6] - doc: add puskin to collaborators (Giovanni Bucci) #58308 [d06db658fc] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499 [3c6206cac9]