GitHub Release: nodejs/node v26.12.0 (14.10.2026)

Notable Changes

• [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533


• [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

• [30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608


• [adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604


• [2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599


• [4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535


• [493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423


• [e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602


• [a888e51062] - build: support Python 3.15 (Mike McCready) #65750


• [2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626


• [f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697


• [5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559


• [f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413


• [4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413


• [bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413


• [883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413


• [9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413


• [d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413


• [8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411


• [c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312


• [e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652


• [7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655


• [af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663


• [007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627


• [f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620


• [1a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566


• [3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481


• [5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649


• [eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563


• [0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483


• [846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557


• [fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252


• [73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286


• [bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286


• [82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529


• [c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530


• [8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523


• [1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517


• [b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453


• [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533


• [c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455


• [69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483


• [700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483


• [32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488


• [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335


• [115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592


• [447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617


• [1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554


• [062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430


• [05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534


• [2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536


• [83f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #66606


• [6fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448


• [bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565


• [c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #62530


• [51f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #66556


• [1aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436


• [dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #66553


• [9648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483


• [d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411


• [c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #66302


• [5b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #66260


• [9ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463


• [bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #66404


• [54867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #66521


• [4314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #66555


• [0e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #66620


• [06f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #66400


• [2e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431


• [cd86506bc2] - src: mark config file as stable (Marco Ippolito) #66431


• [15ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #66424


• [3f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #66483


• [6cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #66483


• [16833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483


• [af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #66483


• [4b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483


• [f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #66483


• [7ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483


• [dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483


• [995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #66483


• [6eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #66483


• [69d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #66483


• [6b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #66483


• [8a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #66483


• [30cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #66483


• [42ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483


• [fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483


• [e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #66473


• [93596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #65598


• [4ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275


• [cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #66576


• [30814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #65598


• [20441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #66338


• [9618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450


• [c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #66322


• [7d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322


• [d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #66322


• [7309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605


• [da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550


• [b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #66476


• [3d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699


• [714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469


• [fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411


• [dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #66528


• [4760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #66445


• [63c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235


• [ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365