Node fixes addon unload, UTF-8 length, and HTTP idle
A security-stability day: fixes a worker addon unload crash, speeds Buffer.byteLength on large strings, and closes idle pre-request sockets correctly.
Read the issue →A security-stability day: fixes a worker addon unload crash, speeds Buffer.byteLength on large strings, and closes idle pre-request sockets correctly.
Read the issue →Shutdown-safe watch mode, inspector-friendly type stripping, and a stream flush fast path landed alongside docs and API cleanup.
Read the issue →Node.js patches a crypto allocation failure path and fixes recursive fs watch ENOENT races; docs and tooling also updated.
Read the issue →
June 2nd, 2026 · 18 commits
+9
Node.js sped up coverage reporting, fixed a zlib crash edge case, tightened Navigator brand checks, and refactored libnode/snapshot build logic.
Read the issue →Two stream bugs fixed, HTTP/2 abort handling revamped, plus a UTF-8/Latin1 encode fast path and a ppcle build tweak.
Read the issue →Node adds QUIC endpoint listing, fixes pending broadcast iterator cleanup, and normalizes -0 across many APIs.
Read the issue →Node adds configurable HTTP header value validation and fixes a SAB-backed Buffer TOCTOU race, alongside cleanup and build/docs tweaks.
Read the issue →Node adds mount-aware VFS dispatch, raises Buffer.poolSize, and tightens warning handling; npm also gets a fresh upgrade.
Read the issue →
May 28th, 2026 · 12 commits
+4
QUIC gets proper failure codes, HTTP/2 session close ordering is fixed, and stream/share iteration plus test runner coverage improve.
Read the issue →
May 27th, 2026 · 12 commits
+5
Notable bug fixes landed in streams, encoding, VM interception, FFI, and webstorage, alongside doc and CI cleanup.
Read the issue →
May 26th, 2026 · 14 commits
+6
Node adds runtime permission revocation, refreshes root certs, and fixes a crypto -0 crash alongside several docs and tooling updates.
Read the issue →
May 25th, 2026 · 21 commits
+2
QUIC gained hostname verification, new rate limits, block lists, and idle stream timeouts; WebCrypto tests/docs were also tightened.
Read the issue →
May 24th, 2026 · 10 commits
+2
A retry-state bug could hide real failures, while FFI signature fields were renamed and test runner watch behavior got more reliable.
Read the issue →A big day for Node.js: experimental node:vfs lands, WebCrypto gets hardened and refactored, and stream/iter fixes improve correctness.
Read the issue →Probe failures now surface clearly, Writable.toWeb avoids a drain race, and npm 11.15.0 plus FFI and build docs were updated.
Read the issue →
May 21st, 2026 · 41 commits
+4
Node.js adds DTLS experimentally, expands QUIC APIs, and lands major QUIC performance and safety work.
Read the issue →Release 26.2.0 ships, Windows builds switch to Thin LTO, and WebCrypto WPT coverage expands for ML-KEM serialization/imports.
Read the issue →
May 19th, 2026 · 15 commits
+5
Crypto verify accepts more buffer-like inputs, streams fix write/termination semantics, and SourceMap payloads are now frozen.
Read the issue →Node.js adds Temporal.Instant support to fs stats, with docs and error updates plus a few test and benchmark fixes.
Read the issue →Node added BoringSSL-backed WebCrypto for ML-DSA, ML-KEM, ChaCha20-Poly1305, and AES-KW, plus stream iter fast paths and fixes.
Read the issue →Stream internals fixed two pipe/backpressure bugs, broadcast now validates writev input, and stream.compose is marked stable.
Read the issue →
May 15th, 2026 · 15 commits
+4
New arbitrary 1xx response support landed, alongside stream adapter bug fixes, debugger probe improvements, and QUIC/HTTP2 corrections.
Read the issue →A stream sharing optimization headlines the day, with a few docs, test, and build-file cleanups alongside it.
Read the issue →An LTS patch release plus N-API, module, HTTP, crypto, and build/doc updates.
Read the issue →
May 12th, 2026 · 10 commits
+3
Node fixed macOS system CA handling, added test-runner tags/filtering, and updated wasm Exception JS API support.
Read the issue →
May 11th, 2026 · 10 commits
+2
Debugger docs improve, QUIC gains permission checks, and libffi/crypto support expands across more targets.
Read the issue →Mostly documentation cleanup, plus a clarification that SEA on macOS x64 isn’t supported.
Read the issue →Node.js prunes unused QUIC session-manager plumbing and a stale binding variable, simplifying object construction.
Read the issue →Node.js tightened crypto internals and TLS renegotiation handling, while also refreshing QUIC docs and a few release notes.
Read the issue →Node 26.1.0 ships, with raw key import validation tightened and a sync CJS import hook bug fixed.
Read the issue →