GitHub Release: nodejs/node v26.10.0 (22.09.2026)

Notable Changes

• [c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627


• [eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090


• [64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909


• [2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644


• [080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725


• [13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825


• [a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806


• [0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709


• [3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805


• [f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825


• [3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899


• [336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899

Commits

• [2bf082453b] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449


• [c518831d00] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #65922


• [89bae46e68] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905


• [01cee9dcef] - build: do not use bundled simdutf when built with --shared-simdutf (Antoine du Hamel) #65891


• [20606a4d19] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023


• [a76e97b5c5] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744


• [ac7fcf0cef] - build: sync cargo/rustc version warnings (Richard Lau) #65912


• [f24a495b36] - build: fix quiet default for make builds (Shelley Vohr) #65826


• [c4381765fe] - child_process: clear timeout timer on spawn-time error too (kishore280) #65506


• [8955781eeb] - crypto: remove redundent std::move call (Antoine du Hamel) #66111


• [0b88aa5a15] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108


• [f90d3d3cb0] - crypto: skip private RSA parameters in key details (Filip Skokan) #66108


• [97828d91db] - crypto: use provider EC group names (Filip Skokan) #66108


• [3de05da569] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108


• [ca8ee04594] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #66108


• [54a625e953] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108


• [971adece6a] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966


• [bfb544eb00] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892


• [c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627


• [c58a4e0ba7] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759


• [70edf90851] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908


• [fab5dddd77] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908


• [220a499614] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908


• [f1295e11db] - crypto: read EC curve metadata directly (Filip Skokan) #65908


• [775173a5db] - crypto: optimize private EC JWK import (Filip Skokan) #65908


• [e44669bb7d] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704


• [cd5a7611e9] - crypto: use primordials in HKDF info validation (Filip Skokan) #65704


• [94affce749] - Revert "deps: V8: override depot_tools version" (Richard Lau) #66110


• [870a366c49] - deps: V8: cherry-pick 95efbaf92a0d (Igor Sheludko) #66020


• [d62a452738] - deps: V8: backport a0607c5006b8 (Antoine du Hamel) #65891


• [e8edeffe2d] - deps: update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) #66009


• [eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090


• [2fffb3872d] - doc: fix duplicate 'the' typo in node_platform.cc (Muhammad Al-Muzahid) #66058


• [317abb8131] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #65869


• [1c12f815c2] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #66038


• [2cc17dd67c] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #65877


• [3a69cc1bf4] - doc: clarify QUIC async write backpressure (John Finnerty) #65947


• [549694349d] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #66004


• [3325ded3a8] - doc: fix sign-off format in AGENTS.md (Filip Skokan) #65958


• [89aa2bd10c] - doc: fill in missing zstd docs (James M Snell) #65867


• [8d1ce4d477] - doc: add inoway46 as triager (Yuya Inoue) #65565


• [9a3697c5c7] - doc: document windowsHide for child_process.fork (Christopher Buss) #65887


• [69911bf6b5] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #65868


• [2d0c3fed12] - doc: add DOMException section to errors API reference (Avocado) #65206


• [f744023cce] - doc: expand revert commit collaborator instructions (Mike McCready) #65848


• [412399efd3] - doc: clarify supported Python releases (Mike McCready) #65850


• [79331f5779] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #65691


• [6ddbb9982f] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #65956


• [64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909


• [07fcf1ed02] - ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size (Soul Lee) #65842


• [b7406b0a9b] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521


• [cb9995be4d] - fs: honor dereference for symlinks nested in cpSync trees (Christian Aurich) #65731


• [2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644


• [9b3f1aa03f] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #64124


• [2b502e0798] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #64453


• [77d8f17ab1] - http: don't destroy socket after request completes (Barath Raj) #65952


• [46f76ed57b] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016


• [205443721d] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #65116


• [7e1db4724a] - inspector: report an error when DOM storage is unavailable (Avocado) #65973


• [95110712b8] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #65877


• [9fd3e6caa4] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818


• [cce2795ad7] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #66014


• [2c0ccc0067] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #58842


• [28acafe6a0] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910


• [b9b0e33923] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #65838


• [7f514d3310] - lib: fix shared buffer growability validation (Filip Skokan) #65845


• [7534117e38] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857


• [bdacc08fbe] - lib: validate sequence iterator objects (Filip Skokan) #65844


• [5b6ac71fb2] - lib: use Web IDL interface brand checks (Filip Skokan) #65846


• [da341e2571] - lib,src: apply multiple updates to dtls implementation (James M Snell) #65511


• [13eb4843d5] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #66044


• [0f759174af] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046


• [c75b830082] - meta: bump cachix/cachix-action (dependabot[bot]) #66047


• [1ada7055a4] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #66048


• [1ed8b05742] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #66049


• [9165abe840] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050


• [d03e7313cf] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #65965


• [53d7592378] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962


• [fa972d02b2] - meta: add web-standards as webidl owners (Filip Skokan) #65856


• [080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725


• [0d14c0e507] - path: remove StringPrototypeCharCodeAt from some methods of posix (Wiyeong Seo) #54668


• [13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825


• [a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806


• [32401c2229] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #65985


• [5e2fbfe0e5] - perf_hooks: validate import normalization offset (Matteo Collina) #65950


• [4743cd8d33] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #65970


• [0df54fb38f] - quic: improve stream cleanup & lookup (Tim Perry) #65944


• [7cf448889c] - quic: fix timeout regression from 11ed325 (James M Snell) #66028


• [61a98e6512] - quic: fix readable stream truncation on stop-sending, abort & timeout (Tim Perry) #63967


• [975cac593c] - quic: add promise to QuicStream for pending strms (Marten Richter) #65862


• [ae29cc92ea] - quic: split headers out from src/quic/stream.{h/cc} (James M Snell) #65863


• [833c58d9dc] - quic: fix crash in onStreamClose (Marten Richter) #65861


• [84ecb21343] - quic: reject zero addressLRUSize (Christian Aurich) #65827


• [293e69d065] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #66026


• [6f5fb76d0e] - sqlite: track registered user-defined functions (Trivikram Kamat) #65896


• [baf112b639] - sqlite: always copy changeset before applying (Trivikram Kamat) #65870


• [0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709


• [1f24901c0c] - src: fix -Wextra warning in WriteFileSync (Antoine du Hamel) #66020


• [b98787fe2d] - src: reuse crypto GetCipherInfo in DTLS session (Ilyas Shabi) #66022


• [410093dbf7] - src: avoid union type-punning in trace values (Khaidi Chu) #65933


• [9ec030b1e7] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991


• [a0f99f1d6c] - src: support building with the V8 sandbox (Shelley Vohr) #62237


• [27c62235d0] - src: ffi: create fast-call metadata Symbols lazily (Matteo Collina) #66015


• [5a5abd8fd0] - src: avoid copying SEA snapshot data (Colin McDonnell) #65876


• [a05023f331] - src: fix crash on empty, foreign or truncated --snapshot-blob files (Shelley Vohr) #65955


• [4141e22606] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #65054


• [05f4e54eda] - src: fix external reference list race between concurrent isolates (Shelley Vohr) #65779


• [1518b7d67f] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #65779


• [62e2bf025c] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778


• [afc3e559d2] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819


• [f245e53b29] - src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG (Colin McDonnell) #65796


• [830ca7df7a] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #65820


• [48158fba8c] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #65792


• [3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805


• [e5d2a336bd] - stream: destroy half-open sockets after iteration (Matteo Collina) #65986


• [4075161405] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #65963


• [7d245cfd8d] - stream: fixup stream/iter to drop at most one entry per share call (James M Snell) #66028


• [30e1f7651c] - stream: reject unbounded at SyncShare construction (James M Snell) #66028


• [0372056cd8] - stream: make share budget failures detach before throwing (James M Snell) #66028


• [36cc238dce] - stream: make Broadcast.from abort its background pump (James M Snell) #66028


• [3134ca6f8e] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #66028


• [04e5c282a1] - stream: fix async iteration of undefined chunks (Caleb Everett) #65969


• [f81a1483b3] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625


• [aec01c5ae1] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625


• [898cd55bdf] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #65727


• [5661526006] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773


• [fb8a97f46b] - stream: improve handling of falsy errors in stream/iter (James M Snell) #65864


• [cfee7fa3d9] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #65847


• [15605210f8] - stream: create write request objects lazily (Matteo Collina) #64455


• [619470a9ae] - stream: allocate stream read buffers from a slab (Matteo Collina) #64455


• [7e79c33354] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108


• [dcc9c3c02a] - test: avoid call to chmodSync in test-fs-cp-async-file-modes (Antoine du Hamel) #66104


• [dda22c06d7] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035


• [d63928dda0] - test: move permission FFI test to native suite (Yuya Inoue) #66059


• [80c1bf7fb5] - test: deflake user timing WPT assertions (Filip Skokan) #66036


• [12116d1d70] - test: unskip test-watch-create-isolation-none (Antoine du Hamel) #66041


• [e90575cb4d] - test: deflake util.throttle tests (Filip Skokan) #66034


• [f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825


• [bfa6d49b5c] - test: implement low-risk test optimizations (James M Snell) #65926


• [c3307ebddf] - test: update WPT for WebCryptoAPI to 55ce71bb9d (Node.js GitHub Bot) #65813


• [ee29c56993] - test: prevent parser reuse across close scenarios (Filip Skokan) #66017


• [8a27474044] - test: cover cpSync fast path timestamp preservation (Abhinandan Kumar) #65678


• [89297305c0] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008


• [d4cb916624] - test: skip test-vfs-real-provider-watch.js on IBM i (SRAVANI GUNDEPALLI) #65987


• [6515db8ab6] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983


• [fa19ecad9d] - test: improve sequential test performance (James M Snell) #65928


• [3666d6a238] - test: schedule WPT variants individually (Filip Skokan) #65984


• [f2aa27d82d] - test: overlap SLH-DSA signature checks (Filip Skokan) #65980


• [2170207253] - test: unref cancelled broadcast source timer (Filip Skokan) #65980


• [71a54aaf5f] - test: collect timeout signals explicitly (Filip Skokan) #65980


• [1a15aff897] - test: skip retries in DNS timeout coverage (Filip Skokan) #65980


• [5c7e6b4a6e] - test: synchronize ordered runner events (Filip Skokan) #65980


• [37f24eddc9] - test: reuse fixed primes in DH tests (Filip Skokan) #65980


• [831ec42bcc] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980


• [f523342bcd] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980


• [f23847a122] - test: use named parameters in DH stress test (Filip Skokan) #65980


• [7131e3b437] - test: reduce ZIP64 stress test I/O (Filip Skokan) #65980


• [e4ca72a984] - test: avoid allocations in external memory test (Filip Skokan) #65975


• [7fe64727a2] - test: cover experimental stream iterator builtins (Jungwon Sohn) #65964


• [88ba17bae2] - test: deflake node-api test-free-called (Christian Aurich) #65948


• [6eee01fbae] - test: fix flaky common WPT inspector test (Yuya Inoue) #65937


• [858702e51c] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906


• [472215ff9b] - test: try fixing windows build replacing WMIC (James M Snell) #65949


• [7f5168149c] - test: fix flaky test-bench-stream (Matteo Collina) #65874


• [9f2d544576] - test: move sqlite length validation out of the reentry test (Trevor Burnham) #65769


• [75a9fa65ac] - test: fix flaky cleanup in http2 test (Tim Perry) #65701


• [f8cdf05586] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #65762


• [88b12c03cd] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #65951


• [9b3085e660] - test_runner: fix quote escaping in JUnit (Jihwan) #65971


• [02c2302c31] - tls: propagate singleUse to the secure context (Carlos Vinicius) #66025


• [2a8b5d9269] - tls: load all CRLs from a PEM bundle (Lazizbek Ergashev) #65577


• [d141ddb8dc] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105


• [b7fe779632] - tools: update tools/v8 for Python 3.13 (Richard Lau) #66109


• [6105b37a3d] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102


• [060ed69df9] - tools: disable fortify warnings in test-shared (Antoine du Hamel) #66020


• [f8b7a2ff41] - tools: clean up handling of shared libs in shell.nix (Antoine du Hamel) #65891


• [3c9586c1fc] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057


• [aa531a34f7] - tools: summarize auto-start-ci failures (Filip Skokan) #65979


• [b7eef15f59] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #66045


• [8914947d7c] - tools: update pgo build doc for linux (Chengzhong Wu) #66024


• [a5b1659d5b] - tools: avoid workflow shell interpolation (Filip Skokan) #66013


• [caf0ee0d7b] - tools: use self-repository references (Filip Skokan) #66013


• [d5880dcb05] - tools: correct Slack action version comments (Filip Skokan) #66013


• [66f182f565] - tools: make checkout credential use explicit (Filip Skokan) #66013


• [287ece3f22] - tools: pass author to commit message validator (Filip Skokan) #66012


• [6314ccf93b] - tools: reduce test runner timing overhead (Filip Skokan) #65980


• [441350a867] - tools: do not download build tools when linting Nix files (Antoine du Hamel) #65961


• [15f2549f74] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #65931


• [0e449d02a6] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #65932


• [81eba460b5] - tools: fix commit queue error summary matching (Filip Skokan) #65913


• [e5bbcfdd78] - tools: lint PR commit messages without approval (Filip Skokan) #65875


• [07ae602005] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872


• [e3ad68289a] - tools: improve benchmark build cache reuse (Filip Skokan) #65859


• [46ddc0220d] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #65785


• [66fd78803d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #65954


• [3cb3c23a19] - typings: add task_queue internal binding types (Seongeun Lee) #65662


• [c5c7036e7b] - typings: add timeoutInfo to TimersBinding (greenhead) #65811


• [62fe96c166] - typings: add missing sea binding properties (이혜미) #65815


• [e51673b4ed] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #65925


• [3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899


• [336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899


• [16e3e7eff3] - vfs: add --vfs-mount and --vfs-load startup flags (Philipp Dunkel) #65748


• [c50cb9a553] - vfs: write RealFSProvider files to open fd (Christian Aurich) #65885


• [1bbc5488a5] - vfs: close the fs hook gaps for mounted paths (Philipp Dunkel) #65852


• [816790e0e5] - vfs: resolve symlinks when checking rename descendants (Trivikram Kamat) #65904


• [a9149093df] - vfs: support renaming implicit ZIP directories (Trivikram Kamat) #65752


• [cf5d4a8fe6] - vfs: reject statfs for missing paths (Trivikram Kamat) #65693


• [de552bd044] - vfs: return FileHandle from fs.promises.open (Trivikram Kamat) #65730


• [08f96f142e] - vfs: give ZipProvider option bags a null prototype (Philipp Dunkel) #65853


• [5c4d319028] - vfs: commit ZipProvider handles the way open(2) does (Philipp Dunkel) #65853


• [29d3406b6c] - vfs: apply open(2) effects to ZipProvider handles (Philipp Dunkel) #65853


• [e379c26a92] - vfs: align virtual file handles with open(2) (Philipp Dunkel) #65854


• [7cdf5f014a] - vfs: answer for unowned paths under reserved root (Philipp Dunkel) #65814


• [5e55085bc1] - zlib: reject invalid zstd dictionaries (James M Snell) #65867


• [4cdcf7f6a4] - zlib: fix zstd reset (James M Snell) #65867


• [678ff3561a] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865