Node.js 24 to 25

Notable Changes Test runner module mocking improvements MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single option MockModuleOptions.exports to align with user expectations and other test

This is a security release. Notable Changes (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High (CVE-2026-21711)

Notable Changes [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083 Commits [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033 [b26d1c7

Notable Changes [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343 [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298 [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for dia

Notable Changes [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713 [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813 [ee59127664] - sqlite: mark

Notable Changes [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 Commits [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456 [a727054503] - deps: upgrade npm to 11.9.0 (

Notable Changes [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415 [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503 [dce657071e] - (SEMVER-MINOR) s

Notable Changes [99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419 [fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167 [0feab0f083] - (SEMVER-MINOR) deps: add tools and sc

Notable Changes [8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959 [bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956 [7930d7a19b] - crypto: update root certificates to NS

This is a security release. Notable Changes lib: (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750 permission: (CVE-2026-21636) add network check on pipe_wrap connect (R

This release reverts the spec-compliant behavior of sometimes throwing on localStorage access. We received feedback that this change on an experimental API was too breaking for a semver-minor release, so we decided to push it back for Node.

Notable Changes [a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982 [4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351 [727560a96d] - (SEMVER-MINOR) module: mark typ

Notable Changes [4395fe14b9] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [2e55c6ad04] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217 [f437204491] - (SEMVER-MINOR) src:

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements, built-in Uint8Array base64/hex conversion, and ongoing WebAssembly and JIT pipeline optimizations. This release doubles down on secure-