Notable Changes

• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
• [2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
• [5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
• [5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
• [e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
• [ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
• [df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
• [74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
• [478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
• [c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
• [c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
• [c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
• [f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
• [2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
• [4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
• [12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
• [474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
• [718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
• [657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
• [75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
• [07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
• [f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
• [8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
• [5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
• [4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
• [c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
• [2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
• [b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
• [70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
• [308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
• [8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
• [bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
• [ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
• [1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
• [63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
• [b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
• [f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
• [16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
• [335c28cd17] - doc: fix typos in documentation (greenhead) #64900
• [d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
• [e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
• [7089bd9ae4] - doc: add missing float32...

Notable Changes

• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

Commits

• [248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
• [d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
• [d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
• [6c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482
• [612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
• [29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
• [2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
• [33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
• [11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
• [6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
• [195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
• [ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
• [32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
• [e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
• [cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
• [04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
• [59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
• [e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
• [0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
• [46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
• [3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
• [c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
• [ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
• [d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
• [8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
• [df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
• [8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
• [7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
• [8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
• [c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
• [9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
• [5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
• [7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
• [cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
• [ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
• [018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
• [cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
• [e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
• [0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
• [d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
• [394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
• [9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
• [6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
• [b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
• [03e9c738f3] - doc: update a Dispatcher undic...

Notable Changes

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

Commits

• [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
• [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
• [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
• [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
• [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
• [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
• [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [1ac93cc05a] - ...

This is a security release.

Notable Changes

• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

• [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712
• [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
• [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
• [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 6.28.0 (Node.js GitHub Bot)

Commits

• [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714
• [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
• [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
• [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
• [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

Notable Changes

New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes

• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

Commits

• [87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #64157
• [06c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605
• [518309c363] - build: suppress clang errors building libffi on Windows (René) #64222
• [6a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
• [66f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [7f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [32bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [0908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [7f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282
• [af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
• [2e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
• [74e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101
• [a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101
• [feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #64101
• [8ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
• [9e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
• [dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407
• [a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #63660
• [8d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
• [da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
• [20ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
• [05eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
• [3966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #64184
• [12a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
• [0854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
• [ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960
• [bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
• [ff537ba858] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
• [f3db304588] - doc: update list of people in SECURITY.md (Richard Lau) #64152
• [2a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #64143
• [85fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130
• [189e830eb3] - doc: add missing option to man page (Richard Lau) #64156
• [7a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931
• [d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #64068
• [60abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
• [e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
• [851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260
• [[0cd443df39](https://github.co...

Notable Changes

• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

Commits

• [c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
• [509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
• [86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
• [d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
• [1124c0652d] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
• [a2324246b4] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [2a467a5f69] - Revert "build, doc: generate node.1 with doc-kit" (Antoine du Hamel) #64091
• [e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
• [2ab9848fe4] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [04c04c8b5c] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [f9fdce3f46] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [656e57ebbf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [57ae87640a] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [88011a3689] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
• [4438cb5284] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
• [9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
• [373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
• [e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
• [b1b597c797] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
• [0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
• [e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
• [e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
• [d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
• [bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
• [971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
• [[`e...

Notable Changes

• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834

Commits

• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
• [7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
• [2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
• [e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
• [ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
• [3d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
• [f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
• [e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
• [56e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
• [3bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [1bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [4433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111
• [b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111
• [ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
• [26781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
• [aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
• [407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [61826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
• [16d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
• [3b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
• [141de35399] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
• [b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #63602
• [4ec142314c] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
• [19e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #63463
• [8a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
• [50c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
• [6e56f01c4b] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
• [3ba813b242] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222
• [2390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
• [52a1c18374] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
• [3e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
• [84d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
• [7da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
• [3d79bd8b29] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
• [4f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROT...

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004