2026-09-16, Version 26.9.0 (Current), @aduh95 — Node.js - Product release notes & changelog tool

Notable Changes

[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[5198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #63653
[5af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894

Commits

[59dcad3f44] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #65606
[6bdb6dd8fa] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587
[49d40091ba] - benchmark: add –analyze option to benchmark/scatter.js (James M Snell) #65594
[bd40a9a19a] - benchmark: add crypto class benchmarks (Filip Skokan) #65518
[6bff2238f5] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #65605
[37d12946dd] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #65430
[02f8eb3b2d] - build: add --shared-perfetto flag (Antoine du Hamel) #65614
[fe7032ec41] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786
[109f2caf80] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797
[55213fd8a8] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237
[120929a1b3] - build: add --shared-highway configure flag (Antoine du Hamel) #65686
[c99af0942b] - build: add --shared-abseil configure flag (Antoine du Hamel) #65682
[431c2bf0eb] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464
[b6b5764c6e] - build: remove obsolete configure flags (Chengzhong Wu) #65456
[a623ee29d9] - build,src: make –use-largepages a no-op (Joyee Cheung) #65389
[2f494cb7aa] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649
[501d8ac815] - crypto: cache valid ECDH key pairs (Filip Skokan) #65615
[3fd905ea8f] - crypto: add strict mode to –force-fips (Filip Skokan) #65645
[54b3cdb805] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645
[3e6e931fc9] - crypto: fix public PKCS8 export error (한국) #65609
[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[eef579047c] - crypto: validate JWK usages before key_ops (Filip Skokan) #65550
[9a9b137a24] - crypto: fix private SPKI export error (Filip Skokan) #65550
[9941fb5dab] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550
[09b431596a] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450
[e6b34e6f7a] - crypto: harden X509Certificate state (Filip Skokan) #65518
[a884b6ccbc] - crypto: optimize key slot caching (Filip Skokan) #65518
[fb512086d3] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457
[656504ffc0] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112
[15e7884732] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503
[3302bec74a] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #65503
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[0539e90110] - deps: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) #65833
[e34af820da] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #65834
[5fb7ffebc2] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #65835
[05cdf1db62] - deps: V8: backport 1a0089053443 (Jakob Linke) #65764
[8910f7914a] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #65764
[e7fd388424] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764
[82715158b8] - deps: V8: backport f3d4d458fe59 (Olivier Flückiger) #65702
[7003159885] - diagnostics_channel: lazily create tracing context (Romain Lanz) #65513
[a97def782f] - doc: clarify node:bench significance policy (James M Snell) #65631
[c74091647d] - doc: clarify isolation modes for node:bench (James M Snell) #65631
[3ef81a676c] - doc: clarify measurement integrity details of node:bench (James M Snell) #65631
[6b565d7b2c] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436
[724981287c] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434
[f8b627c09b] - doc: fix default limit of maxHeadersCount (Aryn H) #65472
[aa3d94fc1d] - doc: fix return types for sync methods (Chiang Fong Lee) #58575
[fe9f452ddd] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #64993
[6b84ee66fa] - errors: validate constructor name (Christian Aurich) #65607
[ed1b629901] - events: fix weak listener retention overwrite (Aryan) #64024
[7b4c17f723] - ffi: throw on missing memory helper arguments (Soul Lee) #65500
[cf78d4260e] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #65735
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[bdcb6def4e] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #65415
[5d24a8fe37] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #65488
[40bdf32d91] - fs: give directories created by cpSync the source directory’s mode (Shelley Vohr) #65488
[6ac1bc040f] - fs: write files in one thread pool round trip (Shelley Vohr) #65489
[b4b89c08c1] - fs: handle recursive watch setup races (Filip Skokan) #65699
[54a1311d9e] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #64817
[2130460831] - fs: improve performance of recursive directory read (Aviv Keller) #65524
[ab7f4c88b7] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435
[e990324e7a] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486
[b6db21972a] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540
[d418ca140e] - fs: fix recursive watch error handling (Filip Skokan) #65635
[ea372bf9c9] - fs: cancel in-flight stat on abort (Mert Can Altin) #63142
[458664073e] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #61233
[34b38235c3] - fs: add maxDepth option to glob (Alexander Lichter) #64003
[e3cc0d9313] - http: fast-forward teardown of unread messages (Matteo Collina) #65732
[f9175a212c] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987
[b4a7cd3efb] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440
[b7e97f6cfd] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249
[d62989dbdf] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #63814
[8aba314f87] - https: limit proxy CONNECT response headers (Matteo Collina) #64545
[bea74e1cb5] - lib: put node:bench behind an –experimental-bench flag (James M Snell) #65920
[2835523960] - lib: fixup node:bench handling of –require option (James M Snell) #65631
[aae83d87a4] - lib: improve diagnostic message support (James M Snell) #65631
[ba7baed423] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #65631
[55103db988] - lib: add runFile api to node:bench (James M Snell) #65631
[0a4c50eb76] - lib: add context.diagnostic api to node:bench (James M Snell) #65631
[476e25e864] - lib: add bench:plan event to node:bench (James M Snell) #65631
[67cf0e556f] - lib: clarify mean in node:bench docs (James M Snell) #65631
[f85f72ad42] - lib: improve node:bench stream handling (James M Snell) #65631
[b32b09f56b] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #65631
[4b9b53f958] - (SEMVER-MINOR) lib: add node:bench explicit createRunner (James M Snell) #65606
[d9f18171f0] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606
[c39e20e9ca] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[46863a7f9c] - lib: use Float16Array from primordials (Antoine du Hamel) #65702
[cbd0948138] - lib: defer source map payload decoding until first use (Shelley Vohr) #65490
[1ddb1c8934] - lib: optimize async context frame activation (Tim Perry) #65519
[02f6feef7e] - lib: use validateArray for array arguments (JunHwan Choi) #65344
[962795ab8c] - lib: apply minor dtls cleanups (James M Snell) #63539
[c07b2ab8a9] - lib,benchmark: address multiple review issues (James M Snell) #65631
[54a5e25f72] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418
[c93a90cf12] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125
[506d23b76f] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #63619
[81cd6d7b78] - net: improve dtls cert verification (James M Snell) #64314
[51d094e26b] - node-api: make object property arrays const (Yilong Li) #65621
[875c7ecee2] - node-api: enter env context for async callbacks (Shelley Vohr) #65406
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[09b333bcc5] - perf_hooks: add missing resource timing attributes (greenhead) #65017
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[67a78317dd] - permission: do not enforce fs and addons in audit mode (Issac) #65659
[19e69e5f72] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492
[168af4d8d7] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431
[855fff682f] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688
[d30df2a3e1] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #65522
[fce1b6a482] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315
[c721aabfb7] - quic: apply multiple fixes to flow control signaling (James M Snell) #65309
[2c552cd32c] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410
[487662717b] - sea: mount bundled assets as a virtual file system (Matteo Collina) #65675
[0ec15a2a54] - sea: keep ELF segments on separate pages in –build-sea output (Shelley Vohr) #65564
[1627fd6561] - sqlite: re-validate database state after reading options (Trevor Burnham) #65595
[18c3867d19] - sqlite: run backup completion in callback scope (Filip Skokan) #65666
[a77d738683] - sqlite: copy changeset before applying it (Matteo Collina) #65286
[b5f0558c84] - sqlite: reject closing a session from a callback (Trevor Burnham) #65454
[5f95032859] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #65465
[2ce0e2eb10] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #65449
[f66ed89136] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #65630
[14613fdc3e] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #65606
[6db3f662cf] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #65684
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[760337aa5b] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520
[f2a588c385] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #65407
[2fd50ae915] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327
[e260fd146c] - src: reuse cached strings in CompileSerializeMain (agape1225) #65453
[0650dca863] - src: add missing vector include (Filip Skokan) #65622
[6e9d44d1fe] - src: disable V8 external memory reasonable size check (Paul Bouchon) #65589
[9c46e56303] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517
[a0aaff6b07] - src: list scripts when --run has no command (James Ross) #64606
[469590c155] - src: fixup manual new/delete usages (James M Snell) #65348
[5902acf031] - src: make the options structs smaller with packed bits (James M Snell) #65145
[0c24639a5a] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #63182
[652fbc286e] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[76538d519c] - stream: use webidl validation semantics for args (James M Snell) #65658
[649a4aba93] - stream: ensure that stateful transforms preserve this (James M Snell) #65658
[23220992c0] - stream: fix nested async flushing with infinite sources (James M Snell) #65658
[3ad1338139] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658
[cafdee6369] - stream: apply source normalization once at call time (James M Snell) #65658
[edb83cb620] - stream: make consumer signals on longer alter source precedence (James M Snell) #65658
[56bdd765df] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658
[037c07af2b] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #65658
[7308492d48] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #65658
[756773477b] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658
[042b951312] - stream: ensure factory signals remain active through closing (James M Snell) #65658
[2dc09ca9ca] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #65658
[9192fbb6dd] - stream: skip unobserved ‘readable’ emission at EOF (Matteo Collina) #65749
[dc25a61e7a] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #65548
[82ae196af6] - stream: address stream/iter review feedback (James M Snell) #65652
[3b37b48592] - stream: replace object sentinel with symbol (James M Snell) #65652
[b6424b6612] - stream: ensure pipeToSync requires synchronous close (James M Snell) #65652
[830fc81acf] - stream: cancel active stream/iter pulls (James M Snell) #65652
[30606908de] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #65652
[7319198755] - stream: ensure full-close semantics when closed (James M Snell) #65652
[bf5acb783f] - stream: defend against re-entrancy in writev (James M Snell) #65652
[b01594f93a] - stream: ensure stability of stored metadata (James M Snell) #65652
[7bfd81ab09] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #65652
[dc2483c38d] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #65652
[f6fac6f7f0] - stream: fixup cancelation handling in pull() (James M Snell) #65652
[dfe0617e71] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633
[900fae0a24] - test: split test-bench-cli to try deflaking it (James M Snell) #65919
[31f4bd73b2] - test: make node:bench test samples survive a coarse clock (Shelley Vohr) #65780
[e0fa1893c3] - test: do not dump core in external memory limit test (Shelley Vohr) #65780
[00ad283b8d] - test: zero-fill buffers before the string length limit check (Christian Aurich) #65755
[70763fcc46] - test: expand test coverage of node:bench (James M Snell) #65631
[5a38e6b115] - (SEMVER-MINOR) test: fix node:bench test timing (James M Snell) #65606
[536ae0e24b] - (SEMVER-MINOR) test: improve node:bench test coverage (James M Snell) #65606
[eec66d529c] - (SEMVER-MINOR) test: update bench tests to not fail on no-crypto (James M Snell) #65606
[ce7b349de5] - test: bump WPT webidl and interfaces (Filip Skokan) #65679
[ec96f8dc23] - test: update WPT for url to c23755a144 (Node.js GitHub Bot) #65651
[ebe2ac248b] - test: fix recursive fs.watch error fixture (Filip Skokan) #65683
[a19912ee8f] - test: update streams WPT (Jeong SeokChan) #65638
[14b5dfc63d] - test: remove console.log call in node_run_list (Antoine du Hamel) #65572
[3f67df139c] - test: expect node:ffi to be enabled by default (Matteo Collina) #65636
[b9ee2e67bf] - (SEMVER-MINOR) test: use native builder for legacy SEA tests (Filip Skokan) #65553
[53a29d0894] - test: use common spawnSync helpers in more tests (greenhead) #65552
[5c680a50f4] - test: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) #65245
[6f99474912] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #65554
[2342b2bf30] - test: cover Readable.from() sync iterator errors (jakecastelli) #65515
[1e455a4ffe] - test: support inspecting WPTs in child processes (Filip Skokan) #65510
[1f7cab588e] - test: document WPT runner workflows (Filip Skokan) #65510
[d39a902cec] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #65372
[90d1b863f7] - test: keep WPT backend checks alive (Filip Skokan) #65320
[be60c34b52] - (SEMVER-MINOR) test: enable multi-global WPTs (Filip Skokan) #64894
[d04cfcda8e] - (SEMVER-MINOR) test: add opt-in process WPT runner (Filip Skokan) #64894
[715c21f805] - (SEMVER-MINOR) test: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) #64894
[9aa8489a01] - test: fix lint in dtls tests (Matteo Collina) #64902
[6a3d8a6d9f] - tls: read the peer certificate chain without consuming it (Tony Gies) #65602
[2e519f8fef] - tls,quic: commonize TLS cert handling between tls, dtls & quic (Tim Perry) #64711
[2266c14051] - tools: add GHA workflow to test vendored Perfetto (Antoine du Hamel) #65614
[19779f121f] - tools: fix the list of globals in ESLint config files (Antoine du Hamel) #65281
[b57db8dfd3] - typings: add types for performance binding (Jungwon Sohn) #65574
[371e2260f4] - typings: add encodeIntoResults to EncodingBinding (greenhead) #65350
[417cdd8a77] - typings: add typing for permission binding (Seungmin Nam) #65385
[a82cc7097f] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #65498
[0e8f7b96b0] - util: canonicalize namespaced tags in inspect() (René) #63257
[acd2bb10ce] - v8: add setHeapProfileNearHeapLimit (Ilyas Shabi) #64676
[d0535b1041] - vfs: load native addons from a mounted file system (Philipp Dunkel) #65680
[ea6f70ba41] - vfs: fix rename over non-empty directory (Christian Aurich) #65613
[b4f6b3798a] - vfs: add ZipProvider (Philipp Dunkel) #64915
[5198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #63653
[38192126e2] - worker: start worker threads from the built-in snapshot (Shelley Vohr) #65336
[56144ea80a] - worker: add ref/unref to web workers (Aviv Keller) #65507
[7231c13b8a] - (SEMVER-MINOR) worker: add wpt tests for Web Workers (Aviv Keller) #64894
[5af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894
[069a1b1200] - zlib: avoid waiting for paused ZIP iterators (Trivikram Kamat) #65278