GitHub Release: nodejs/node v26.8.0 (26.08.2026)

$ git clone https://github.com/nodejs/node.git Clone

Notable Changes

• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [

Commits

• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [ (ulofiai) ] - deps: update perfetto to 57.2 (Node.js GitHub Bot) ] - deps: float ICU-23262 patch for icu78 (René) ] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) ] - deps: update undici to 8.10.0 (Node.js GitHub Bot) ] - deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) ] - deps: update libffi to 3.8.0 (Node.js GitHub Bot) ] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) ] - diagnostics_channel: validate before channel activation (Trivikram Kamat) ] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) ] - dns: validate address type in lookupService (Lazizbek Ergashev) ] - dns: validate port range in setServers() (René) ] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) ] - doc: update AHAFS reference link (Taeuk Ha) ] - doc: fix property names in os.networkInterfaces() example (Jihwan) ] - doc: fix broken links in cli.md (Donghoon Kang) ] - doc: remove outdated WASI version fallback (이혜미) ] - doc: fix broken GYP link in n-api.md (Donghoon Kang) ] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) ] - doc: fix broken TLS security level example (soreavis) ] - doc: clarify socket destroyed behavior (Dayun) ] - doc: update outdated nodejs.org guide links (Donghoon Kang) ] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) ] - doc: clarify how fs.Dirent file types are determined (soreavis) ] - doc: update security release prepare command (Rafael Gonzaga) ] - doc: clarify copyFile symlink behavior (T) ] - doc: document setRawMode write access on Windows (Erik Demaine) ] - doc: document per-architecture fast FFI argument limits (Seongeun Lee) ] - doc: add missing return types in fs.md (Chaseton Collins) ] - doc: add missing return types in buffer.md (Yuya Inoue) ] - doc: fix lint clean command (greenhead) ] - doc: fix typo in onboarding.md (서울민트초코) ] - doc: add missing added: tags to fs.lchmod (Lazizbek Ergashev) ] - doc: fix SQLite changeset constant descriptions (greenhead) ] - doc: document open pull request limit (Matteo Collina) ] - doc: document http2 header constants (Harjoth Khara) ] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) ] - doc: fix broken fs.BigIntStats link in vfs.md (greenhead) ] - doc: update synopsis (Augustin Mauroy) ] - doc: document close() error when in a sqlite callback (Trivikram Kamat) ] - doc: fix broken internal links (greenhead) ] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) ] - doc: fix permission documentation examples (greenhead) ] - doc: document sqlite parameter binding (Guilherme Araújo) ] - doc: finalize statements in sqlite examples (Guilherme Araújo) ] - doc: document quic stopSending() and resetStream() (Issac) ] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) ] - doc: remove usage of util.inherits (Augustin Mauroy) ] - doc: fix grammar in worker_threads.md (이혜미) ] - doc: fix broken link (Antoine du Hamel) ] - doc: update node.1 to fix linter (Antoine du Hamel) ] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) ] - doc: remove --expose-gc flag from CLI documentation (Dario Piotrowicz) ] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) ] - doc: correct default highWaterMark values (Yilong Li) ] - doc: use ffi.suffix in permission example (agape1225) ] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) ] - esm: only register text format when enabled (Efe Karasakal) ] - esm: fix wasm import name in error message (이혜미) ] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) ] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) ] - ffi: prefer canonical type names (Trivikram Kamat) ] - ffi: validate the value passed to the float setters (Soul Lee) ] - ffi: reject direct SharedArrayBuffer pointers (Trivikram Kamat) ] - ffi: remove dead null check in callback arguments (Trivikram Kamat) ] - ffi: keep FFI functions non-constructible (Trivikram Kamat) ] - ffi: refresh cached string buffers on every call (Trivikram Kamat) ] - ffi: reject detached ArrayBufferViews (Trivikram Kamat) ] - ffi: reject detached ArrayBuffers as pointers (Trivikram Kamat) ] - ffi: validate fast pointer BigInt argument ranges (Trivikram Kamat) ] - ffi: reuse the callable created per symbol (Trivikram Kamat) ] - ffi: shrink trampoline placement probe window (Trivikram Kamat) ] - ffi: accept pointer BigInts in multi-argument fast calls (Trivikram Kamat) ] - ffi: support SharedArrayBuffer in getRawPointer (Junsoo Ha) ] - ffi: reuse libffi call plans (Yilong Li) ] - fs: stop stat()ing every entry in recursive readdir (Shelley Vohr) ] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) ] - fs: fix realpath of namespaced drive paths (Jason Zhang) ] - fs: abort in-flight stat operations (Mert Can Altin) ] - fs: fix glob early return skipping sibling entries (Srinu desetti) ] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) ] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) ] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) ] - fs: treat std::errc::permission_denied as EPERM error (Kirill Saied) ] - fs: read small files in one thread pool round trip (Shelley Vohr) ] - Revert "fs: fix close listener leak in FileHandle streams" (Mike McCready) ] - fs: fix close listener leak in FileHandle streams (Y1D7NG) ] - fs: add windowsHandle option to file streams (Kirill Saied) ] - http: improve performance with known-length calls to end() (Tim Perry) ] - http: use intrusive lists in ConnectionsList (Matteo Collina) ] - http: cache maxHeaderPairs per header section (GetThatCookie) ] - http: fix keylog listener setup on existing agent sockets (Shani Singh) ] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) ] - http2: avoid uaf while receiving and sending rst_stream (esgor) ] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) ] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) ] - lib: load fewer builtins when bootstrapping without a snapshot (Shelley Vohr) ] - lib: fix ERR_INVALID_ARG_TYPE with --enable-source-maps (June) ] - lib: harden webidl dictionary member reads (Filip Skokan) ] - lib: use validateArray for array arguments (greenhead) ] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) ] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) ] - meta: add a root-level AGENTS.md (James M Snell) ] - meta: move targos to emeritus (Michaël Zasso) ] - meta: add unified http api initiative (James M Snell) ] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) ] - meta: add support for alpha prerelease tag (Antoine du Hamel) ] - meta: add Aviv Keller to .mailmap (Aviv Keller) ] - meta: update sccache to 0.17.0 (René) ] - module: add a read-only mode to the compile cache (Shelley Vohr) ] - module: do not split a portable compile cache by uid (Shelley Vohr) ] - module: report unreadable package.json (Paul Bouchon) ] - module: cache nearest parent package.json per directory (Shelley Vohr) ] - module: fix --check on ambiguous ESM files (Paul Bouchon) ] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) ] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) ] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) ] - permission: guard UDP handle adoption (Rafael Gonzaga) ] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) ] - process: validate resource stats array offsets (Archkon) ] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) ] - quic: mark drain promise handled (James M Snell) ] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) ] - quic: write desired size needs update on maxstream (Marten Richter) ] - quic: do not destroy incoming streams that have a consumer (trivenay) ] - quic: fix wake up blob (Marten Richter) ] - quic: convert incoming :status header to number (Hallison Pereira Melo) ] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) ] - repl: keep entries added while history file is loading (Mhayk Whandson) ] - repl: add benchmarks (Aviv Keller) ] - repl: add basic syntax highlighting (Aviv Keller) ] - sea: avoid dangling CLI option pointers (Archkon) ] - sea: handle NUL bytes in asset keys (Archkon) ] - sea: reject trailing content in config JSON (Archkon) ] - sea: reject malformed --node-options values (Archkon) ] - sqlite: reject reentry while binding parameters (Trevor Burnham) ] - sqlite: remove unused column name helper (Trivikram Kamat) ] - sqlite: reject busy statement finalization in authorizer (Trivikram Kamat) ] - sqlite: prevent reentrant session.close() (Trivikram Kamat) ] - sqlite: reuse cached column names in statement all() and get() (Edy Silva) ] - sqlite: validate StatementSync.run() integers (Trivikram Kamat) ] - sqlite: add diagnostic channel (Guilherme Araújo) ] - sqlite: add stmt persistent flag (Guilherme Araújo) ] - sqlite: reject connection access from authorizer callbacks (Trevor Burnham) ] - sqlite: expose prepared statement statistics (Edy Silva) ] - sqlite: manage sqlite3_stmt lifetime with RAII (Guilherme Araújo) ] - sqlite: check sqlite3_step() and sqlite3_reset() results (semimikoh) ] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) ] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) ] - sqlite: isolate applyChangeset filter errors (Trivikram Kamat) ] - sqlite: reject deserialize() while in a callback (Trivikram Kamat) ] - sqlite: check null returns from sqlite value functions (Nora Dossche) ] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) ] - sqlite: refactor error helpers and user function pointers (Ali Hassan) ] - sqlite: reject non-positive backup rates (Trivikram Kamat) ] - sqlite: clear SQLTagStore bindings (Matteo Collina) ] - sqlite: bind Boolean (mike-git374) ] - sqlite: fix undefined behaviour in Session::Changeset() (Nora Dossche) ] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) ] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) ] - sqlite: bind ArrayBuffer (mike-git374) ] - sqlite: prevent database close during callbacks (Matteo Collina) ] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) ] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) ] - src: use simdutf for two-byte utf8 conversion (Mert Can Altin) ] - src: run same-priority platform tasks in posting order (Shelley Vohr) ] - src: define O_SYNC, O_DSYNC and O_DIRECT on Windows (Kirill Saied) ] - src: use simdutf for two-byte strings in UTF-8 writes (Shelley Vohr) ] - src: add v8::Local specialization for MaybeStackBuffer (James M Snell) ] - src: escape Windows environment variables in task runner (Antoine du Hamel) ] - src: apply minor namespace format tweak in permissions (James M Snell) ] - src: simplify permissions with BooleanPermissions (James M Snell) ] - src: simplify includes in permissions (James M Snell) ] - src: apply a modest performance perf to permissions (James M Snell) ] - src: make permission storage a bit more efficient (James M Snell) ] - src: apply multiple general cleanups to permissions (James M Snell) ] - src: simplify c++ diagnostics channel API (James M Snell) ] - src: make minor cleanup to permission checks (James M Snell) ] - src: use DictionaryTemplate for permission diag channel message (James M Snell) ] - src: cache permission strings (James M Snell) ] - src: shave about 20 bytes off each TLSWrap instance (James M Snell) ] - src: add SetAbortHandler (Max H Fisher) ] - src: use concepts where appropriate (James M Snell) ] - src: match cmd.exe case-insensitively in task runner (Archkon) ] - src: reuse cached env strings in remaining files (Seongeun Lee) ] - src: expose Windows-only fs open flags (Kirill Saied) ] - src: report why --enable-fips failed (Filip Skokan) ] - src: update repeated use strings to env (James M Snell) ] - src: use UTF-8 for task runner filesystem paths (Archkon) ] - stream: normalize fused stateless transform results (Trivikram Kamat) ] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) ] - stream: prevent share from eagerly draining source (Trivikram Kamat) ] - stream: drain pending writes before broadcast end (Trivikram Kamat) ] - stream: reuse unexposed managed read buffers (GetThatCookie) ] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) ] - stream: decouple transform backpressure changes (Matteo Collina) ] - stream: reject pull on signal abort during flush (Trivikram Kamat) ] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) ] - stream: use validateObject for zlib/iter params (greenhead) ] - stream: use validateNumber for BYOB reader options.min (greenhead) ] - stream: consolidate non-op algorithm callbacks (Matteo Collina) ] - stream: cut promise churn in webstreams hot paths (Matteo Collina) ] - stream: speed up async iteration of Readable (Matteo Collina) ] - stream: preserve falsy cancellation reasons (Trivikram Kamat) ] - stream: use validateBuffer for BYOB reader view (greenhead) ] - stream: fix recursive WritableStream abort (Jeong SeokChan) ] - string_decoder: decode UTF-8 via StringBytes::Encode (Shelley Vohr) ] - test: update WPT for WebCryptoAPI to e235e089b4 (Node.js GitHub Bot) ] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) ] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) ] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) ] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) ] - test: add Headers coverage and benchmark (Yagiz Nizipli) ] - test: deflake test-net-listen-ipv6only (sangwook) ] - test: use common/child_process spawnSync helpers (Junsoo Ha) ] - test: fix Linux debug skip in SEA test guard (구현우) ] - test: add closed-library assertions for getFunctions and getSymbols (Anshika Jain) ] - test: avoid timer race in event loop delay test (Trivikram Kamat) ] - test: enforce exit code in test-http-server-stale-close (Antoine du Hamel) ] - test: convert test-async-local-storage-bind to async loop (freida-code) ] - test: replace forEach() with for...of in parallel tests (Phillip Markert) ] - test: convert forEach to for in test-constant.js file (NIxxy25) ] - test: use for-of instead of forEach (Felix P.) ] - test: wait for FFI background optimization (Trivikram Kamat) ] - test: add a simple test for import defer of a CJS module (Maya Lekova) ] - test: cover ZIP fd lifecycle and add rollback (Philipp Dunkel) ] - test: cover ZIP header-confusion and DoS guards (Philipp Dunkel) ] - test: cover realpathSync resolving symlinks after a FIFO stat (Hendrik Liebau) ] - test: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) ] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) ] - test: add permission fast api test (James M Snell) ] - test: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) ] - test: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) ] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) ] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) ] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) ] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) ] - test: use libuv clock for immediate queue test (Trivikram Kamat) ] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) ] - test: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) ] - test: prefer in-memory databases in sqlite tests (Paul Bouchon) ] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) ] - test_runner: match dotfiles in default coverage exclude (semimikoh) ] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) ] - test_runner: use run options with isolation="none" (Sylvester Keil) ] - test_runner: mock dual-package with conditional exports (Maruthan G) ] - test_runner: restore directory search for --test (Paul Bouchon) ] - test_runner: add classname hierarchy for JUnit reporter (mag123c) ] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) ] - test_runner: extend tag filter with boolean expression DSL (Chemi Atlow) ] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) ] - test_runner: fix env option validation (Jihwan) ] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) ] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) ] - tls: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) ] - tls: drop hand-rolled TLS client hello parser (Tim Perry) ] - tools: improve commit queue failure comment (Filip Skokan) ] - tools: improve nix-changes coverage (Antoine du Hamel) ] - tools: refactor shell.nix pkcs11 integration to its own section (Antoine du Hamel) ] - tools: fix max body length handler in create-release-proposal.sh (Antoine du Hamel) ] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) ] - tools: make env variables consistent in cron jobs (Antoine du Hamel) ] - tools: fix man-page generation on Windows (James Ross) ] - tools: bump undici from 6.27.0 to 6.28.0 in /tools/doc (dependabot[bot]) ] - tools: fix linter when permittedInsecurePackages is empty (Antoine du Hamel) ] - tools: update BoringSSL pin on v26.x (Filip Skokan) ] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) ] - tools: fix quote escaping in update-nixpkgs-pin.sh (Antoine du Hamel) ] - tools: remove skip logic in commit-queue.sh (Antoine du Hamel) ] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) ] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) ] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) ] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) ] - tools: delay removal of commit-queue label (Antoine du Hamel) ] - tools: move ncu config to global for commit queue (Filip Skokan) ] - tools: prefilter commit queue metadata (Filip Skokan) ] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) ] - tools: fix pkcs11-store-test check (Antoine du Hamel) ] - tools: add an OpenSSL FIPS build to test-shared.yml (Filip Skokan) ] - tools: sync mk-ca-bundle.pl with curl (Archkon) ] - tools: store "default" OpenSSL version in openssl-matrix.nix (Antoine du Hamel) ] - tools: remove true from branch name for auto-update automation (Antoine du Hamel) ] - tools: add ./tools/nix/pkcs11.nix to nix-changes.yml (Filip Skokan) ] - tty: add raw-vt and io raw modes (Samuel Williams) ] - typings: add signal_wrap internal binding types (Seongeun Lee) ] - typings: add diagnostics_channel typings (Seongeun Lee) ] - typings: add watchdog internal binding types (Seongeun Lee) ] - typings: add internal_only_v8 binding typeis (Donghoon Kang) ] - typings: add credentials internal binding types (Donghoon Kang) ] - url: skip unused href reuse comparison (Yagiz Nizipli) ] - url: speed up WHATWG URL parsing (Yagiz Nizipli) ] - url: speed up URLSearchParams (Yagiz Nizipli) ] - url: bounds-check short Windows file URL paths (Archkon) ] - url: handle unparsable serialized URLs in setters (Matteo Collina) ] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) ] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) ] - util: fix formatting of functions returned from getters (Richard Gibson) ] - util: use more primordials in comparisons.js (Ayoub Mabrouk) ] - util: preserve function names without source map names (Hiroki Osame) ] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) ] - zlib: roll back a failed add() directory rewrite (Philipp Dunkel) ] - zlib: let a ZipFile read finish before close() (Philipp Dunkel) ] - zlib: do not hang archiving a FIFO or device (Philipp Dunkel) ] - zlib: reject local/central ZIP header mismatch (Philipp Dunkel) ] - zlib: validate central directory record count (Matteo Collina) ] - zlib: reject ambiguous ZIP archive ends (Matteo Collina) ] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) ] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601