Node.js

Summary

Updated crypto subsystem: new root certificates (NSS 3.123.1), added TurboSHAKE, KangarooTwelve, ML‑KEM and other algorithms, hardened WebCrypto checks and unified key import handling.

Summary

Fixed unexpected behavior introduced by the prior security release (22.23.0).

Summary

Fixed multiple high‑severity security bugs in TLS, crypto, HTTP/2, DNS, and permission handling (e.g., hostname normalization, WebCrypto output length guard, SNI case‑sensitivity)

Summary

Strengthened TLS and DNS security: hostname normalization for server identity, case‑sensitive SNI fix, rejecting hostnames with embedded NUL bytes, and binding reusable sessions to authenticated hosts.

Summary

TLS hardening: normalize hostnames for server identity, fix case‑sensitive SNI matching, and bind reusable sessions to authenticated hosts

Summary

Increase Buffer.poolSize default to 64 KiB and add new Buffer‑related improvements; introduce httpValidation option for stricter header validation and permission.drop API; upgrade crypto root certificates to NSS 3.123.1, harden WebCrypto...

Summary

Implemented crypto.randomUUIDv7() and added Ed25519 context support along with key usage deduplication;

Summary

Added new minor features: Temporal.Instant support in fs Stats/BigIntStats, writeInformation for arbitrary 1xx HTTP status codes, and marked stream.compose as stable

Summary

Fixed multiple security issues including a crypto null‑pointer dereference, URL parsing crash for malformed UNC hostnames, a zlib use‑after‑free on reset, HTTP keep‑alive socket reuse race, and an HTTP/2 file‑handle leak

Summary

Security release updates bundled dependencies and runtime patches.

Summary

Add experimental node:ffi module for loading native libraries (requires --experimental-ffi flag and appropriate permission; API is unsafe).

Summary

Temporal API is now enabled by default, providing a modern date‑time API;

Summary

Added new CLI options (max-heap-size, require module handling) and stabilized require(esm) and module compile cache.

Summary

Test runner mock module API unified via MockModuleOptions.exports with automated migration support.

Summary

Wrapped SNICallback in try/catch and added timing‑safe HMAC/KMAC comparisons, null‑prototype header objects, and permission checks for pipe, realpath.native, and fs/promises to address several high‑severity CVEs

Summary

Fix multiple high‑ and medium‑severity CVEs (e.g., null‑prototype headers, SNICallback try/catch, array index hash collision, timing‑safe crypto comparisons, NGHTTP2 flow‑control handling, URL format crash, permission checks for fs.promi...

Summary

Wrap SNICallback invocation in a try/catch to mitigate crashes (CVE‑2026‑21637).

Summary

Fixed multiple CVE‑related vulnerabilities including array index hash collisions, timing‑side‑channel issues in Web Crypto HMAC/KMAC, and unsafe header prototypes

Summary

Fixed critical bugs such as use‑after‑free in http, extension‑less CJS handling in ES modules, importKey argument checks, and several stream and crypto issues.

Summary

Updated crypto root certificates to NSS 3.119/3.117 and corrected RSA‑PSS saltLength default, enhancing TLS security

Summary

Build system now tests on Python 3.14 and adds sccache persistence improvements.

Summary

Added a limits property to SQLite DatabaseSync, C++ support for diagnostics channels, and a permission audit API.

Summary

Add http1Options and strictSingleValueFields options to http2 for HTTP/1 fallback and relaxed header validation

Summary

Add new options and APIs: async_hooks.trackPromises, fs.watch ignore, http.setGlobalProxyFromEnv, module subpath imports starting with '/', stream.bytes() consumer, and test runner env and fail‑expectation options.

Summary

Replaced the CJS module lexer with the new merve parser

Summary

Added Python 3.14 support and updated build scripts for the new interpreter

Summary

Added trackPromises option to async_hooks.createHook() for better promise tracking.

Summary

Added LIEF dependency and tooling, introduced ignore option for fs.watch, enabled SQLite defensive mode by default, and added direct SEA build support with Node.js binary.

Summary

Added new stable APIs and utilities (require module handling, http.setGlobalProxyFromEnv, convertProcessSignalToExitCode, subpath imports with leading slash, V8.queryObjects)

Summary

Implemented multiple CVE fixes: added TLSSocket default error handler, network checks on pipe/wrap connect, stricter symlink read/write permissions, disabled futimes under permission model, rethrown stack overflow exceptions in async hoo...

Summary

Add TLSSocket default error handler (CVE‑2025‑59465) and route TLS callback exceptions through error handlers (CVE‑2026‑21637).

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Fixed multiple CVE vulnerabilities (disabled futimes with permission model, added TLSSocket default error handler, required full read/write for symlink APIs, rethrown stack overflow in async hooks, removed zero‑fill toggle from unsafe bu...

Summary

Added new runtime options such as http.optimizeEmptyRequests, watch config namespace, portable compile‑cache flag, sqlite defensive flag, and inspector inspection ability

Summary

Updated crypto root certificates to NSS 3.114/3.116 and added security escalation and incident response documentation.

Summary

Reverts previous change that threw errors on localStorage access, restoring prior behavior

Summary

Added configurable options to util.deprecate and marked type‑stripping as a stable module feature.

Summary

Fixed Buffer.allocUnsafe to return uninitialized memory as documented, resolving a known issue.

Summary

Add http server option optimizeEmptyRequests, SQLite defensive flag, and watch config namespace; introduce optional disabling of source‑phase imports and experimental IsolateGroups support

Summary

Add passive listener spec compliance and extend SPrintF functions to accept std::string_view, enhancing API flexibility.

Summary

Node.js 24.x transitions to LTS (codename Krypton) with support through April 2028.

Summary

Added built‑in proxy support (CLI env proxy, HTTP/HTTPS request and Agent) and a new `shouldUpgradeCallback` for server‑controlled HTTP upgrades.

Summary

Upgrade to V8 14.1 adds faster JSON.stringify, built‑in Uint8Array base64/hex conversion, WebAssembly JSPI and other JIT optimizations.

Summary

Added per‑stream `inspectOptions` to the console API.

Summary

Add `shouldUpgradeCallback` to HTTP server API, enabling servers to control protocol upgrades and fixing related HTTP/2 upgrade handling.

Summary

Update bundled OpenSSL to 3.5.2, extending Node.js 22.x security support through 2027 and updating root certificates to NSS 3.114

Summary

Added Chrome DevTools network inspection for HTTP/2 calls in Node.js

Summary

Fixed a SHAKE128/256 crypto bug introduced by OpenSSL 3.4, restoring correct hashing behavior.

Summary

Introduce new CLI options (NODE_USE_SYSTEM_CA, ${pid} placeholder) and a threadCpuUsage API.

Summary

Added post‑quantum cryptography support (ML KEM, ML DSA) via new crypto.encapsulate/decapsulate methods and extended Web Crypto API with algorithms like AES‑OCB, ChaCha20‑Poly1305, SHA‑3, SHAKE, etc.

Summary

Add NODE_USE_SYSTEM_CA=1 flag to CLI for using system‑provided TLS root certificates.

Summary

Upgrade Node.js to ship OpenSSL 3.5.1, extending TLS support and security updates.

Summary

Enabled experimental type stripping by default, allowing Node.js to execute TypeScript files without extra configuration (can be disabled with --no-experimental-strip-types).

Summary

Fixed CVE‑2025‑27210: prevented Windows reserved device names (CON, PRN, AUX) from bypassing path.normalize() protection.

Summary

- Fixed CVE‑2025‑27210 by handling Windows reserved device names (CON, PRN, AUX) and tightening path.normalize() traversal protection.

Summary

Patched CVE-2025-27209: mitigated HashDoS in V8 by reverting recent rapidhash changes.

Summary

Added crypto.hash outputLength option for XOF functions and fixed SHAKE128/256 compatibility with OpenSSL 3.4.

Summary

Deprecate instantiating node:http classes without new, passing an empty string to options.shell, and HTTP/2 priority signaling; future versions may error or remove them.

Summary

Added async iterator handling for burst file system events and introduced the fileURLToPathBuffer API in the URL module.

Summary

Graduated WebCryptoAPI Ed25519 and X25519 algorithms to stable and added support for zero‑length HKDF/PBKDF2 and non‑byte‑aligned deriveBits in SubtleCrypto

Summary

Remove HTTP/2 priority signaling (breaking change) and deprecate related APIs

Summary

Added explicit Dir resource management and URL support for fs.glob's cwd option (SEMVER minor feature).

Summary

Graduated multiple experimental APIs to stable, including import.meta properties, top‑level Wasm, SQLite StatementSync.columns(), and default node.config.json support;

Summary

Fix error handling for async crypto operations to address CVE‑2025‑23166

Summary

Fix CVE-2025-23166 by correcting error handling on async crypto operations

Summary

Fixed error handling in async crypto operations (CVE‑2025‑23166).

Summary

Fix error handling on async crypto operations (CVE‑2025‑23166) – introduces breaking changes.

Summary

Reverted the SlowBuffer move to End‑of‑Life.

Summary

Upgrade to V8 13.6 and npm 11, bringing new language features (Float16Array, explicit resource management, RegExp.escape, WebAssembly Memory64, Error.isError) and performance/security improvements.

Summary

Enhanced the assertion library with partial error comparison, faster partialDeepStrictEqual, and exposed diff utilities.

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Added partial error comparison and diff support to assert utilities, exposing a diff function for clearer assertion errors.

Summary

Upgrade OpenSSL to 3.0.16 and refresh root certificates to NSS 3.108, improving TLS security

Summary

Added experimental node.config.json support for default flag configuration in test runner and other features

Summary

Enabled require(esm) and module syntax detection by default, removing experimental flags and warnings (can be disabled with no‑experimental options).

Summary

- Added TLSA record query and parsing support in the dns module (new feature).

Summary

Updated crypto root certificates to NSS 3.107 and added OpenSSL 3.4 compatibility – security fix

Summary

Added support for using the system CA certificates store on macOS and Windows via a new flag in the crypto module

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

- ESM modules reach stability: import attributes and JSON module are now stable, plus fallback importer and import‑assertion fixes.

Summary

Updated crypto root certificates to NSS 3.107 and made prime generation/check interruptible, enhancing security

Summary

Fixed HTTP/2 memory leak on premature connection close and addressed ERR_PROTO issues (CVE‑2025‑23085).

Summary

Fix multiple CVEs: internal worker permission check (CVE‑2025‑23083), HTTP/2 memory leak and ERR_PROTO (CVE‑2025‑23085), and Windows path traversal in normalize() (CVE‑2025‑23084)

Summary

Throw on InternalWorker usage when permission model is enabled (CVE‑2025‑23083)

Summary

Added permission check that throws on InternalWorker usage when the permission model is enabled (CVE‑2025‑23083).

Summary

Permission model status upgraded from Active Development to Stable.

Summary

Enabled experimental strip types flag by default, allowing Node.js to execute TypeScript files via STDIN eval and worker eval input (experimental).

Summary

WebCrypto API Ed25519 and X25519 algorithms are now stable, eliminating ExperimentalWarning

Summary

Adds experimental `assert.partialDeepStrictEqual` for partial deep equality checks in tests.

Summary

Enabled experimental require(esm) by default in v22.x, removing ERR_REQUIRE_ESM and adding warnings/ERR_REQUIRE_ASYNC_MODULE handling;

Summary

Added a CLI flag to preserve environment variables during dr and enhanced util.getCallSites with sourcemap support; both are new features.

Summary

Added new benchmark suites (TypeScript, dotenv, ESM detection, ASCII file read) and improved existing benchmarks (deepEqual config, no‑warnings mode).

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Node.js 22.x moves to Active LTS (codename 'Jod') with support through April 2027.