Node.js 26.9.0 release notes, 16 Sep 2026

Notable Changes

[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[5198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #63653
[5af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894

Commits

[59dcad3f44] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #65606
[6bdb6dd8fa] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587
[49d40091ba] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594
[bd40a9a19a] - benchmark: add crypto class benchmarks (Filip Skokan) #65518
[6bff2238f5] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #65605
[37d12946dd] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #65430
[02f8eb3b2d] - build: add --shared-perfetto flag (Antoine du Hamel) #65614
[fe7032ec41] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786
[109f2caf80] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797
[55213fd8a8] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237
[120929a1b3] - build: add --shared-highway configure flag (Antoine du Hamel) #65686
[c99af0942b] - build: add --shared-abseil configure flag (Antoine du Hamel) #65682
[431c2bf0eb] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464
[b6b5764c6e] - build: remove obsolete configure flags (Chengzhong Wu) #65456
[a623ee29d9] - build,src: make --use-largepages a no-op (Joyee Cheung) #65389
[2f494cb7aa] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649
[501d8ac815] - crypto: cache valid ECDH key pairs (Filip Skokan) #65615
[3fd905ea8f] - crypto: add strict mode to --force-fips (Filip Skokan) #65645
[54b3cdb805] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645
[3e6e931fc9] - crypto: fix public PKCS8 export error (한국) #65609
[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[eef579047c] - crypto: validate JWK usages before key_ops (Filip Skokan) #65550
[9a9b137a24] - crypto: fix private SPKI export error (Filip Skokan) #65550
[9941fb5dab] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550
[09b431596a] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450
[e6b34e6f7a] - crypto: harden X509Certificate state (Filip Skokan) #65518
[a884b6ccbc] - crypto: optimize key slot caching (Filip Skokan) #65518
[fb512086d3] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457
[656504ffc0] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112
[15e7884732] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503
[3302bec74a] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #65503
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[0539e90110] - deps: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) #65833
[e34af820da] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #65834
[5fb7ffebc2] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #65835
[05cdf1db62] - deps: V8: backport 1a0089053443 (Jakob Linke) #65764
[8910f7914a] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #65764
[e7fd388424] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764
[82715158b8] - deps: V8: backport f3d4d458fe59 (Olivier Flückiger) #65702
[7003159885] - diagnostics_channel: lazily create tracing context (Romain Lanz) #65513
[a97def782f] - doc: clarify node:bench significance policy (James M Snell) #65631
[c74091647d] - doc: clarify isolation modes for node:bench (James M Snell) #65631
[3ef81a676c] - doc: clarify measurement integrity details of node:bench (James M Snell) #65631
[6b565d7b2c] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436
[724981287c] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434
[f8b627c09b] - doc: fix default limit of maxHeadersCount (Aryn H) #65472
[aa3d94fc1d] - doc: fix return types for sync methods (Chiang Fong Lee) #58575
[fe9f452ddd] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #64993
[6b84ee66fa] - errors: validate constructor name (Christian Aurich) #65607
[ed1b629901] - events: fix weak listener retention overwrite (Aryan) #64024
[7b4c17f723] - ffi: throw on missing memory helper arguments (Soul Lee) #65500
[cf78d4260e] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #65735
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[bdcb6def4e] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #65415
[5d24a8fe37] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #65488
[40bdf32d91] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #65488
[6ac1bc040f] - fs: write files in one thread pool round trip (Shelley Vohr) #65489
[b4b89c08c1] - fs: handle recursive watch setup races (Filip Skokan) #65699
[54a1311d9e] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #64817
[2130460831] - fs: improve performance of recursive directory read (Aviv Keller) #65524
[ab7f4c88b7] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435
[e990324e7a] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486
[b6db21972a] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540
[d418ca140e] - fs: fix recursive watch error handling (Filip Skokan) #65635
[ea372bf9c9] - fs: cancel in-flight stat on abort (Mert Can Altin) #63142
[458664073e] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #61233
[34b38235c3] - fs: add maxDepth option to glob (Alexander Lichter) #64003
[e3cc0d9313] - http: fast-forward teardown of unread messages (Matteo Collina) #65732
[f9175a212c] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987
[b4a7cd3efb] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440
[b7e97f6cfd] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249
[d62989dbdf] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #63814
[8aba314f87] - https: limit proxy CONNECT response headers (Matteo Collina) #64545
[bea74e1cb5] - lib: put node:bench behind an --experimental-bench flag (James M Snell) #65920
[2835523960] - lib: fixup node:bench handling of --require option (James M Snell) #65631
[aae83d87a4] - lib: improve diagnostic message support (James M Snell) #65631
[ba7baed423] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #65631
[55103db988] - lib: add runFile api to node:bench (James M Snell) #65631
[0a4c50eb76] - lib: add context.diagnostic api to node:bench (James M Snell) #65631
[476e25e864] - lib: add bench:plan event to node:bench (James M Snell) #65631
[67cf0e556f] - lib: clarify mean in node:bench docs (James M Snell) #65631
[f85f72ad42] - lib: improve node:bench stream handling (James M Snell) #65631
[b32b09f56b] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #65631
[4b9b53f958] - (SEMVER-MINOR) lib: add node:bench explicit createRunner (James M Snell) #65606
[d9f18171f0] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606
[c39e20e9ca] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[46863a7f9c] - lib: use Float16Array from primordials (Antoine du Hamel) #65702
[cbd0948138] - lib: defer source map payload decoding until first use (Shelley Vohr) #65490
[1ddb1c8934] - lib: optimize async context frame activation (Tim Perry) #65519
[02f6feef7e] - lib: use validateArray for array arguments (JunHwan Choi) #65344
[962795ab8c] - lib: apply minor dtls cleanups (James M Snell) #63539
[c07b2ab8a9] - lib,benchmark: address multiple review issues (James M Snell) #65631
[54a5e25f72] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418
[c93a90cf12] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125
[506d23b76f] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #63619
[81cd6d7b78] - net: improve dtls cert verification (James M Snell) #64314
[51d094e26b] - node-api: make object property arrays const (Yilong Li) #65621
[875c7ecee2] - node-api: enter env context for async callbacks (Shelley Vohr) #65406
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[09b333bcc5] - perf_hooks: add missing resource timing attributes (greenhead) #65017
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[67a78317dd] - permission: do not enforce fs and addons in audit mode (Issac) #65659
[19e69e5f72] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492
[168af4d8d7] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431
[855fff682f] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688
[d30df2a3e1] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #65522
[fce1b6a482] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315
[c721aabfb7] - quic: apply multiple fixes to flow control signaling (James M Snell) #65309
[2c552cd32c] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410
[487662717b] - sea: mount bundled assets as a virtual file system (Matteo Collina) #65675
[0ec15a2a54] - sea: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) #65564
[1627fd6561] - sqlite: re-validate database state after reading options (Trevor Burnham) #65595
[18c3867d19] - sqlite: run backup completion in callback scope (Filip Skokan) #65666
[a77d738683] - sqlite: copy changeset before applying it (Matteo Collina) #65286
[b5f0558c84] - sqlite: reject closing a session from a callback (Trevor Burnham) #65454
[5f95032859] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #65465
[2ce0e2eb10] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #65449
[f66ed89136] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #65630
[14613fdc3e] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #65606
[6db3f662cf] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #65684
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[760337aa5b] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520
[f2a588c385] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #65407
[2fd50ae915] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327
[e260fd146c] - src: reuse cached strings in CompileSerializeMain (agape1225) #65453
[0650dca863] - src: add missing vector include (Filip Skokan) #65622
[6e9d44d1fe] - src: disable V8 external memory reasonable size check (Paul Bouchon) #65589
[9c46e56303] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517
[a0aaff6b07] - src: list scripts when --run has no command (James Ross) #64606
[469590c155] - src: fixup manual new/delete usages (James M Snell) #65348
[5902acf031] - src: make the options structs smaller with packed bits (James M Snell) #65145
[0c24639a5a] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #63182
[652fbc286e] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[76538d519c] - stream: use webidl validation semantics for args (James M Snell) #65658
[649a4aba93] - stream: ensure that stateful transforms preserve this (James M Snell) #65658
[23220992c0] - stream: fix nested async flushing with infinite sources (James M Snell) #65658
[3ad1338139] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658
[cafdee6369] - stream: apply source normalization once at call time (James M Snell) #65658
[edb83cb620] - stream: make consumer signals on longer alter source precedence (James M Snell) #65658
[56bdd765df] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658
[037c07af2b] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #65658
[7308492d48] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #65658
[756773477b] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658
[042b951312] - stream: ensure factory signals remain active through closing (James M Snell) #65658
[2dc09ca9ca] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #65658
[9192fbb6dd] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina)

These notes run past the length kept in the archive. The rest is on the publisher’s page.