2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

2026-10-28, Version 24.22.2 'Krypton' (LTS), @aduh95

Commits

• [f8bdcd54ed] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
• [3b93fd6b2b] - deps: V8: backport 1a0089053443 (Jakob Linke) #65764
• [5aaf62faaa] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #65764
• [3b8eb1a920] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764
• [ab70b5d681] - deps: V8: cherry-pick 853553fe755c (Victor Gomes) #66241
• [17ec999f24] - stream: keep async context of parked writes (Matteo Collina) #66907

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
• (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
• (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
• deps: V8: backport 93cd21e8254b (Joyee Cheung)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• tls: reject chains containing blocked public keys (Ulises Gascon)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
• crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

• [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
• [12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
• [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
• [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
• [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
• [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95

This is a security release.

Notable Changes

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update undici to 7.30.1 (Node.js GitHub Bot)

Commits

• [2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
• [9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008
• [18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764
• [843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871
• [935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95

This is a security release.

Notable Changes

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
• deps: update undici to 6.29.1 (Node.js GitHub Bot)

Commits

• [68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
• [512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
• [e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
• [857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765
• [19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [a18ec92752] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
• [d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
• [4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

2026-10-14, Version 26.12.0 (Current), @richardlau

Notable Changes

• [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
• [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

• [30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
• [adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
• [2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
• [4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
• [493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
• [e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
• [a888e51062] - build: support Python 3.15 (Mike McCready) #65750
• [2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
• [f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
• [5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
• [f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
• [4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
• [bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
• [883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
• [9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
• [d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
• [8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
• [c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
• [e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652
• [7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
• [af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
• [007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627
• [f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
• [1a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566
• [3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
• [5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
• [eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
• [0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
• [846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
• [fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
• [73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
• [bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
• [82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
• [c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
• [8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
• [1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
• [b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
• [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
• [c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
• [69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
• [700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
• [32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
• [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
• [115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592
• [447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617
• [1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554
• [062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430
• [05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534
• [2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536
• [83f507845d] - meta: bump...

2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95

Notable Changes

• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
• [c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
• [a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
• [c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
• [51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
• [d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
• [acc1578179] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
• [a7f8de6362] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
• [60c3eb61bd] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
• [6b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
• [75456a3512] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
• [72d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
• [41161dda87] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
• [adbc757d70] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
• [241339f072] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
• [63b0974d9e] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
• [a3bbb5a26f] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899

Commits

• [e6832b2cb1] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449
• [a079177d9f] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #65922
• [10b1a0f70f] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587
• [e0c7ba8ad5] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594
• [21fed10bb0] - benchmark: add crypto class benchmarks (Filip Skokan) #65518
• [fa912242b7] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905
• [a6bd0c1413] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023
• [94e12139ee] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744
• [7a2f322943] - build: fix quiet default for make builds (Shelley Vohr) #65826
• [c280d650b0] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797
• [4b23a4472c] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237
• [676e15c003] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464
• [f784058482] - build: remove obsolete configure flags (Chengzhong Wu) #65456
• [f63f37d243] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
• [da46ac075d] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
• [249e9a16dd] - build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #66082
• [146f00f64b] - child_process: clear timeout timer on spawn-time error too (kishore280) #65506
• [13987f4418] - crypto: remove redundent std::move call (Antoine du Hamel) #66111
• [ef957ac85f] - crypto: skip private RSA parameters in key details (Filip Skokan) #66108
• [8feccc5e22] - crypto: use provider EC group names (Filip Skokan) #66108
• [764e0d1120] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108
• [50ffed1979] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #66108
• [56c16b2fd6] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108
• [a4effe6809] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966
• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
• [8e631aa48f] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759
• [5c51129e16] - crypto: optimize private EC JWK import (Filip Skokan) #65908
• [c2ec40c2d7] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172
• [e198aa0f79] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108
• [253784f0e9] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892
• [80a6ad509b] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908
• [5b592b772c] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908
• [ee956ae3bf] - crypto: export EC JWK coordinates directly (Filip Skokan) [#65908](#6590...

2026-10-07, Version 26.11.1 (Current), @aduh95

Commits

• [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
• [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
• [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

2026-10-07, Version 26.11.0 (Current), @aduh95

Notable Changes

• [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
• [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
• [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
• [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
• [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #65619
• [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
• [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
• [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
• [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
• [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
• [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #66213
• [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
• [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
• [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
• [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

Commits

• [11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420
• [168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #66358
• [69182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #66316
• [12e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334
• [e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278
• [480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257
• [c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #66237
• [85a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121
• [d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325
• [b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #65960
• [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
• [9f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #66449
• [0002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449
• [a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475
• [bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467
• [9acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293
• [6ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #66240
• [2248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136
• [49069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #66228
• [9066d33aa2] - build: port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183
• [1f4a8fb1cb] - build: add v8_enable_temporal_systemicu (Steven R. Loomis) #65992
• [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
• [a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #65325
• [9fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #66348
• [53cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #66217
• [32ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #66237
• [67ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237
• [ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237
• [359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237
• [e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237
• [a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #66237
• [7f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #66237
• [75870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237
• [[a1bea87c6a...

2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbol

Notable Changes

• [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
• [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
• [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
• [a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #65542
• [2a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #65790
• [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
• [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623

Commits

• [44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
• [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [71feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
• [2a3548e51c] - deps: update undici to 6.28.1 (mcollina) #65790
• [59d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
• [a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
• [3376e27de2] - deps: V8: cherry-pick a6eaf7574109 (Camillo Bruni) #65402
• [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
• [4e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
• [7d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
• [01855a19d3] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [23fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375
• [5286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
• [6d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
• [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
• [d9cb8468a3] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
• [c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [37f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
• [7c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166
• [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
• [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
• [ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217
• [839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #65629
• [40eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542
• [75098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065
• [08b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627
• [02cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #62993
• [6f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753
• [bc5753d438] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
• [d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
• [38ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
• [fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
• [e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961
• [5fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651
• [ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108