GitHub Release: nodejs/node v24.20.0 (26.08.2026)

$ git clone https://github.com/nodejs/node.git Clone

Notable Changes

• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [

Commits

• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [


• [ as codeowner for node_url_pattern.* (Efe Karasakal) ] - meta: lower stale to 3 months (Aviv Keller) ] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) ] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) ] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) ] - meta: update sccache version in test-linux-quic (René) ] - net: support TCP handle transfer on Windows (Matteo Collina) ] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) ] - net: support sync connect for BoundSocket (Guy Bedford) ] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) ] - path: add benchmarks for path.matchesGlob() (bq) ] - permission: add unique warning codes (David Evans) ] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) ] - quic: fix stop sending behaviour & callback (Tim Perry) ] - quic: fix coverage comment typo (Jungwon Sohn) ] - quic: fix segfault after fragmented client hello (Tim Perry) ] - quic: serialize stream reset code as string (한만욱) ] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) ] - quic: preserve session stats after close (한만욱) ] - quic: add support for TLS certificate compression (Sebastian Beltran) ] - quic: extract transport logic from Application to Session (Tim Perry) ] - quic: correct http3 callback and fix revealed errs (Marten Richter) ] - quic: fix no onstream handler crash quic (Efe) ] - quic: fix stall datagrams, if no pending streams (Marten Richter) ] - quic: fix potential crash from unobserved closed (Tim Perry) ] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) ] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) ] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) ] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) ] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) ] - quic: impl. cb for http/3 settings/app. options (Marten Richter) ] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) ] - quic: add listEndpoints API (James M Snell) ] - quic: add proper error codes & messages for QUIC failures (Tim Perry) ] - quic: support hostname verification (James M Snell) ] - quic: add stream idle timeout (James M Snell) ] - quic: add block list support for endpoints (James M Snell) ] - quic: improve peer cert verification (James M Snell) ] - quic: handle h3 max header size option (James M Snell) ] - quic: add rate limiting docs (James M Snell) ] - quic: cache timestamp for address lru cache (James M Snell) ] - quic: add session creation rate limiting (James M Snell) ] - quic: refine rate limiting (James M Snell) ] - quic: flip preferred address policy default to 'ignore' (James M Snell) ] - quic: add doc note about certificate size limitations (James M Snell) ] - quic: add applicationOptions to session (James M Snell) ] - quic: add getters for local and remote transport parameters (James M Snell) ] - quic: improve recv coalescing test sizes (James M Snell) ] - quic: add initial RTT option to session options (James M Snell) ] - quic: enable recvmmsg batching in Endpoint (James M Snell) ] - quic: improve stream header collection performance (James M Snell) ] - quic: coalesce received data into fewer buffers (James M Snell) ] - quic: apply multiple additional minor improvements (James M Snell) ] - quic: fix tests that are missing serverEndpoint close (James M Snell) ] - quic: fixup some v8:: qualifiers (James M Snell) ] - quic: fix premature unref of endpoint when listening (James M Snell) ] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) ] - quic: fix UAF in Application::OnTimeout() (James M Snell) ] - quic: improve the quic js structure (James M Snell) ] - quic: improve internal structure of QuicStream (James M Snell) ] - quic: add aliased struct arenas (James M Snell) ] - quic: add handshake timeout and default connection limits (James M Snell) ] - quic: fix crash in early handshake failure (James M Snell) ] - quic: eliminate per-received datagram allocation (James M Snell) ] - quic: cache the timestamp on send and receive (James M Snell) ] - quic: add support for future ECN marking (James M Snell) ] - quic: improve batching of packet sending (James M Snell) ] - quic: improve backend quic packet processing (James M Snell) ] - quic: send correct OpenSSL alert for ALPN mismatches (Tim Perry) ] - quic: fixup quic stream variable chunk len (James M Snell) ] - quic: remove unused env_ variable in session_manager.h/cc (James M Snell) ] - quic: ignore coverage for quic files (James M Snell) ] - quic: complete the internal implementation of QUIC (James M Snell) ] - quic: continue working on quic api bits (James M Snell) ] - readline: reduce createInterface overhead (Matteo Collina) ] - sqlite: invalidate sessions when closing database (Trivikram Kamat) ] - sqlite: check database state before calling SQLite (Trivikram Kamat) ] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) ] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) ] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) ] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) ] - src: avoid redundant KEM encapsulation copies (Filip Skokan) ] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) ] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) ] - src: fix libuv assertion on windows (liuxingbaoyu) ] - src: avoid redundant DataPointer reallocations (Filip Skokan) ] - src: fix comment typos (Jungwon Sohn) ] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) ] - src: fix some typo errors and rename some variables (Archkon) ] - src: make node.config.json throw at unknown fields (Marco Ippolito) ] - src: show original file name in FileHandle GC close errors (Anna Henningsen) ] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) ] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) ] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) ] - stream: preserve push signal abort reason (Trivikram Kamat) ] - stream: skip zero-byte broadcast writes (Trivikram Kamat) ] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) ] - stream: use validateString for consumer encoding (Jungwon Sohn) ] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) ] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) ] - stream: abort pending single-source merge reads (Trivikram Kamat) ] - stream: use RangeError for broadcast overflow (Trivikram Kamat) ] - stream: skip null output from stateful transforms (Trivikram Kamat) ] - stream: update iterable streams to use budget backpressure (James M Snell) ] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) ] - stream: fix drop-newest behavior in share() (Trivikram Kamat) ] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) ] - stream: validate writer options signal (Trivikram Kamat) ] - stream: reject push iterator.throw() with error (Trivikram Kamat) ] - stream: simplify nested PromisePrototypeThens (Antoine du Hamel) ] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) ] - stream: validate writevSync chunks before queuing (Trivikram Kamat) ] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) ] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) ] - stream: reject nested async streamables in from() (Trivikram Kamat) ] - stream: avoid draining merged iter sources (Trivikram Kamat) ] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) ] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) ] - stream: prefer sync iterator in fromSync (Trivikram Kamat) ] - stream: speed up async iteration over WHATWG byte streams (Antoine du Hamel) ] - stream: reject iter consumers on abort (Trivikram Kamat) ] - stream: fix merge abort for pending sources (Trivikram Kamat) ] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) ] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) ] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) ] - stream: respect iter consumer abort signals (Trivikram Kamat) ] - stream: handle falsy push writer fail reasons (Trivikram Kamat) ] - stream: handle setEncoding after buffered data (Matteo Collina) ] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) ] - stream: refine the stream/iter backpressure (James M Snell) ] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) ] - stream: fix pipeToSync byte accounting (Trivikram Kamat) ] - stream: reject pull() reads on abort (Trivikram Kamat) ] - stream: fast-path stateless transform flush results (Trivikram Kamat) ] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) ] - stream: settle pending broadcast reads on return (Trivikram Kamat) ] - stream: serialize concurrent share consumer reads (Trivikram Kamat) ] - stream: fix lint error (Antoine du Hamel) ] - stream: reject pending reads on iterator throw (Trivikram Kamat) ] - stream: wait for push writer end fallback to drain (Trivikram Kamat) ] - stream: flush each fused stateless transform (Trivikram Kamat) ] - stream: avoid duplicate writes in toWritable (Trivikram Kamat) ] - stream: propagate abort reason in share and broadcast (Trivikram Kamat) ] - stream: disallow writing string chunk with 'buffer' encoding (René) ] - stream: align Readable.toWeb termination with eos (ikeyan) ] - stream: add sync iterable fast path to pipeTo (Trivikram Kamat) ] - stream: fix merge handling for object-like sources (Trivikram Kamat) ] - stream: limit iter from sync iterable batches (Trivikram Kamat) ] - stream: cache minimum cursor count in broadcast (Trivikram Kamat) ] - stream: avoid retrying accepted pipeTo writes (Trivikram Kamat) ] - stream: validate broadcast writer writev chunks (Trivikram Kamat) ] - stream: uncork fromWritable writev on chunk error (Trivikram Kamat) ] - stream: validate fromWritable() options before cache (Trivikram Kamat) ] - stream: optimize single-slot push queue drain (Trivikram Kamat) ] - stream: preserve toReadableSync batch after backpressure (Trivikram Kamat) ] - stream: cache minimum cursor count in share (Trivikram Kamat) ] - stream: minor stream/iter implementation edits (René) ] - stream: remove redundant method check from iter.pipeToSync (René) ] - stream: add stream/iter to classic stream adapters (James M Snell) ] - (SEMVER-MINOR) stream: add stream/iter Implementation (James M Snell) ] - stream, quic: update iterable streams backpressure (James M Snell) ] - test: split test-embedding.js and run tests in parallel (Joyee Cheung) ] - test: ensure assertions are reached on all tests (Antoine du Hamel) ] - test: unflake debugger and REPL tests (Matteo Collina) ] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) ] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) ] - test: cover worker throwing primitive values (varshitha) ] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) ] - test: update quic tests for stream/iter update (James M Snell) ] - test: fix flaky http2 socket proxy test (Tim Perry) ] - test: apply correction to comment (Rich Trott) ] - test: keep finalization before-exit ref alive (Tim Perry) ] - test: copyedit test-tls-psk-alpn-callback-exception-handling (Antoine du Hamel) ] - test: fix stale async-context-frame status entries (Kirill Saied) ] - test: update WPT for urlpattern to 5847ee5cfa (Node.js GitHub Bot) ] - test: update WPT for WebCryptoAPI to ec2fee39a4 (Node.js GitHub Bot) ] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) ] - test: fix 2nd flaky blob test case (Tim Perry) ] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) ] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) ] - test: unmark flaky http2-large-file for Win (Kirill Saied) ] - test: increase timeout in consumed-timeout test (Trivikram Kamat) ] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) ] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) ] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) ] - test: get rid of unnecessary AbortController instanciations (Antoine du Hamel) ] - test: update WPT for wasm/jsapi to 288c467d35 (Node.js GitHub Bot) ] - test: fixup quic tests (James M Snell) ] - (SEMVER-MINOR) test: add tests for experimental stream/iter implementation (James M Snell) ] - test: skip quic tests that IBM i does not support (SRAVANI GUNDEPALLI) ] - test_runner: wait for filtered suite build (semimikoh) ] - test_runner: convert to uint during deserialization (Aviv Keller) ] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) ] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) ] - tests: start adding quic test server utilities (James M Snell) ] - timers: do not retain a reference to the async store after firing (Matteo Collina) ] - tls: fix SNICallback certificate selection (Matteo Collina) ] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) ] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) ] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) ] - tools: use 'readonly' for EventSource global (Honey Tyagi) ] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) ] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) ] - tools: disable zipping tarballs on GHA (Antoine du Hamel) ] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) ] - tools: remove envinfo from our workflows (Antoine du Hamel) ] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) ] - tools: add lint rule for aborted AbortController (Trivikram Kamat) ] - typings: add heap_utils internalBinding types (Donghoon Kang) ] - typings: remove isDataView from types binding (Archkon) ] - url: create URLPattern result properties in WebIDL order (Archkon) ] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) ] - v8: report minor mark-sweep in GCProfiler (Archkon) ] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) ] - wasm: register missing SetURL function (Archkon) ] - zlib: validate pledgedSrcSize as a safe integer (Archkon) ] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) ] - zlib: reject truncated zstd input (Archkon) #64593