Node.js 26.7.0 (Current)

Antoine du Hamel

2026-08-05, Version 26.7.0 (Current), @aduh95

Notable Changes

[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

[a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
[d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
[2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
[5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
[5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
[e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
[ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
[df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
[74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
[478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
[c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
[c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
[c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
[f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
[2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
[4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
[12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
[474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
[718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
[657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
[75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
[07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
[f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
[8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
[5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
[4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
[c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
[2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
[b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
[70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
[7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
[308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
[8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
[bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
[ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
[1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
[63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
[b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
[f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
[16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
[335c28cd17] - doc: fix typos in documentation (greenhead) #64900
[d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
[e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
[7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
[8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
[a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
[3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
[70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
[d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
[a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
[e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
[e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
[efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
[db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742
[a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
[1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
[29709324e0] - doc: update technical priorities (Jacob Smith) #64505
[522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
[c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
[428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
[33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
[b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
[48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
[109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
[aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
[ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
[0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
[b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
[e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
[dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
[6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
[6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
[72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
[f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
[3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
[bce92debba] - Revert "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663
[b5d5dd74a1] - Revert "http2: avoid copying the options in respond()" (Antoine du Hamel) #64663
[19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
[d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
[31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
[88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
[9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
[82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
[848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
[ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
[0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #64929
[3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
[d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
[7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
[915cabbfcf] - meta: remove node_crates .gitignore (René) #64779
[8e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
[fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
[eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414
[999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
[7de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
[6289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #64486
[01510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
[dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577
[c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #64585
[14e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
[279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
[bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
[870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
[a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #64721
[6cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
[8725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
[e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #64565
[0611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #64565
[2897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565
[d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
[53b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
[69d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #64721
[1b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
[2632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
[d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
[796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
[ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
[cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
[fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
[f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718
[a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
[b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840
[c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #64631
[9d2f10ec54] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
[75b80d0b7b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
[9a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365
[796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
[a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830
[4368303e01] - test_runner: wait for filtered suite build (semimikoh) #64208
[70d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
[cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
[9ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
[5f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
[b5ced907b3] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787
[fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
[3bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738
[236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
[3def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
[5293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #64813
[4345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573
[b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679
[f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
[44042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

6a26e53441fb7e1097fa0b19616000a030a9b96156eb15a0fe22682cfdf19ad2  node-v26.7.0-aix-ppc64.tar.gz
1c0b19dbbdc485aae6a2a43a647c94ba3b75cb5f191d154f6798344fc84721e3  node-v26.7.0-arm64.msi
7ee659a7768e641bbfd5360940660b8e8fd0052f77488f365562bac522fc15d4  node-v26.7.0-darwin-arm64.tar.gz
595d2f934e081b82961d1a5fd41c6dbd0c5a952d9e8be5b4566ab754426968d2  node-v26.7.0-darwin-arm64.tar.xz
f279d1ed28ce57f7788bf23435d2ad7fdd7438904ad5c4d8a1081a7cde3d4b96  node-v26.7.0-darwin-x64.tar.gz
bd19c6b98d923fb049f64b547163b9f7d52ae73f16fdee09ecef9ab248c4d6ff  node-v26.7.0-darwin-x64.tar.xz
00ef24b4724342592aa7a14f9105282a59a7397c8ff7a28166243f5029ce2217  node-v26.7.0-headers.tar.gz
453153ebefe7999965211df9ad3029f99a3c57b89eded9862e17be7ee0aaf1ba  node-v26.7.0-headers.tar.xz
925aa6157dd37542d0d7f2e28b7bf61e7b39284411210b0498bc3788db4aef68  node-v26.7.0-linux-arm64.tar.gz
afc7a004018485092ac8985b817b0d5684472bd9472e0b57d2ab88737e50090d  node-v26.7.0-linux-arm64.tar.xz
b41dfc68169e20e54d79e0b0443d0acf5b652535a4010a3258d6ddb1d118d914  node-v26.7.0-linux-ppc64le.tar.gz
c3f7cd5c9e149dce1f5955b182c21468ffa20f602aba863ca93cb198b76c07ea  node-v26.7.0-linux-ppc64le.tar.xz
c335e3a78ff723f36c17929390d1bd4003f267befba12c92764acbf6a37267ee  node-v26.7.0-linux-s390x.tar.gz
ff3a5c7b93a2ec4c6188ed9992495363a22892853db7ce466b57ce55119d20f4  node-v26.7.0-linux-s390x.tar.xz
bd6b6c31e377bad9ad579bed72e5bc11f4c879ac9452ad51d30e646ea3d828df  node-v26.7.0-linux-x64.tar.gz
982aa24dd8be4c889c6a8ab337ddff3b0896645b20f4239356e80552c16277ee  node-v26.7.0-linux-x64.tar.xz
a1d534dcb6c060f486d88e126318657725569da9d30cbb47a26ef6cf0d5afa60  node-v26.7.0-win-arm64.7z
be8775204cfceca5a73c30f91bf0de5e85274c01b776dc13f16b91aa251ebb01  node-v26.7.0-win-arm64.zip
073be1a597ff9f0130b067fb35eb84225d3970fdd7a84ee898f4b6270aadec0f  node-v26.7.0-win-x64.7z
d3bd72755141ed32bbcd841228ee81897c8a98d50dfa7dae2179399a0a7c90f8  node-v26.7.0-win-x64.zip
28dd9d5e53f829a32310a4fed334000a1681a7534641c599d05617f893c06a2b  node-v26.7.0-x64.msi
18a470bd132cb3b135455304ae7c86aea23bdd7dce9af5d2fc257ddd2f9a9943  node-v26.7.0.pkg
e7feefd8d65781c9bbca1a128f8c80b357275156e6e15a3ed32cb7992035bdb2  node-v26.7.0.tar.gz
e6b182cbeeab032d1082ca4ac4fe15e3a57de691d3bde78ecf8a761fd56ee356  node-v26.7.0.tar.xz
ed13b0ca216ef8d9e8a1781cf26e95ec7f56983d25beaf46b01cb472132d8e80  win-arm64/node.exe
c01ce0d5e4e956f0e5e73cdba925d15a6d6f86883aa49f8f0b0de87aa93508ce  win-arm64/node.lib
ca037cb8e6ee9029cd5059ad61c1aedf5e7910ba08fa6c6faac2d4f46a7fcb22  win-arm64/node_pdb.7z
5fa0b2b4656f3ccf3e4c0724a5fb8dec73ce34857a47e7921f969de16ed20e25  win-arm64/node_pdb.zip
e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9  win-x64/node.exe
56f06350037085fce04930befd98327afc86ee46f52af6f6f8a68a03630e8380  win-x64/node.lib
c88a9b921f1fd208c2988c5a927d147a3e1dc780549b4f214a18019fec9179c8  win-x64/node_pdb.7z
1b226fa023bdca9c29d93f908eb1ffc32eb43744840eae5b3dd0a940e281429c  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCanNjxgAKCRAgsaOQsWjT
VqE/AQC3EYDZ1vt4D6SgL9Tzanifftq72JN0Z1q9cP9Lruw6vgEAh7yKQmSXDT/Y
Q9C72Rrz5kojCdtdA4mZHTn/Tu45dg4=
=zPSW
-----END PGP SIGNATURE-----

Node.js 26.6.0 (Current)