Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
Node.js
JavaScript runtime for servers and tools.
Latest Node.js changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Node.js release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Node.js updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
Node.js updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
6
14
58
Latest Node.js changelog updates
Added crypto STORE loader support for loading private keys and updated root certificates to NSS 3.125, including Argon2 and FIPS‑mode fixes
Added new APIs: ffi.getCurrentEventLoop, test runner context.log() with test:log event, and pattern cache for matchGlobPattern() (SEMVER MINOR).
Added new APIs such as `buffer.blob.textStream()`, experimental ESM `import text` flag, `ReadableStreamTee`, and synchronous dgram socket methods (`connectSync`, `bindSync`).
Fix multiple high‑severity CVEs across http2, https, permission, dns, sqlite, and zlib components
Patched numerous CVEs (high to low severity) across http2, permission, https, sqlite, dns, zlib, and http modules, enhancing security and stability.
Patched high‑severity CVEs across http2, http, https, dns, permission, and zlib modules, including header memory handling and identity checks.
Added new release key for signing future Node.js releases.
Introduced numerous new APIs and enhancements: caller‑supplied readFile buffers, synchronous dgram connect/bind, TCP KEEPINTVL/KEEPCNT in net.setKeepAlive, TLS certificateCompression option, HTTP idle‑socket cleanup, loader package maps,...
Updated crypto subsystem: new root certificates (NSS 3.123.1), added TurboSHAKE, KangarooTwelve, ML‑KEM and other algorithms, hardened WebCrypto checks and unified key import handling.
Fixed unexpected behavior introduced by the prior security release (22.23.0).
Fixed multiple high‑severity security bugs in TLS, crypto, HTTP/2, DNS, and permission handling (e.g., hostname normalization, WebCrypto output length guard, SNI case‑sensitivity)
Strengthened TLS and DNS security: hostname normalization for server identity, case‑sensitive SNI fix, rejecting hostnames with embedded NUL bytes, and binding reusable sessions to authenticated hosts.
TLS hardening: normalize hostnames for server identity, fix case‑sensitive SNI matching, and bind reusable sessions to authenticated hosts
Increase Buffer.poolSize default to 64 KiB and add new Buffer‑related improvements; introduce httpValidation option for stricter header validation and permission.drop API; upgrade crypto root certificates to NSS 3.123.1, harden WebCrypto...
Implemented crypto.randomUUIDv7() and added Ed25519 context support along with key usage deduplication;
Added new minor features: Temporal.Instant support in fs Stats/BigIntStats, writeInformation for arbitrary 1xx HTTP status codes, and marked stream.compose as stable
Fixed multiple security issues including a crypto null‑pointer dereference, URL parsing crash for malformed UNC hostnames, a zlib use‑after‑free on reset, HTTP keep‑alive socket reuse race, and an HTTP/2 file‑handle leak
Security release updates bundled dependencies and runtime patches.
Add experimental node:ffi module for loading native libraries (requires --experimental-ffi flag and appropriate permission; API is unsafe).
Temporal API is now enabled by default, providing a modern date‑time API;
Added new CLI options (max-heap-size, require module handling) and stabilized require(esm) and module compile cache.
Test runner mock module API unified via MockModuleOptions.exports with automated migration support.
Wrapped SNICallback in try/catch and added timing‑safe HMAC/KMAC comparisons, null‑prototype header objects, and permission checks for pipe, realpath.native, and fs/promises to address several high‑severity CVEs
Fix multiple high‑ and medium‑severity CVEs (e.g., null‑prototype headers, SNICallback try/catch, array index hash collision, timing‑safe crypto comparisons, NGHTTP2 flow‑control handling, URL format crash, permission checks for fs.promi...
Wrap SNICallback invocation in a try/catch to mitigate crashes (CVE‑2026‑21637).
Fixed multiple CVE‑related vulnerabilities including array index hash collisions, timing‑side‑channel issues in Web Crypto HMAC/KMAC, and unsafe header prototypes
Fixed critical bugs such as use‑after‑free in http, extension‑less CJS handling in ES modules, importKey argument checks, and several stream and crypto issues.
Updated crypto root certificates to NSS 3.119/3.117 and corrected RSA‑PSS saltLength default, enhancing TLS security
Build system now tests on Python 3.14 and adds sccache persistence improvements.
Added a limits property to SQLite DatabaseSync, C++ support for diagnostics channels, and a permission audit API.
Add http1Options and strictSingleValueFields options to http2 for HTTP/1 fallback and relaxed header validation
Add new options and APIs: async_hooks.trackPromises, fs.watch ignore, http.setGlobalProxyFromEnv, module subpath imports starting with '/', stream.bytes() consumer, and test runner env and fail‑expectation options.
Replaced the CJS module lexer with the new merve parser
Added Python 3.14 support and updated build scripts for the new interpreter
Added trackPromises option to async_hooks.createHook() for better promise tracking.
Added LIEF dependency and tooling, introduced ignore option for fs.watch, enabled SQLite defensive mode by default, and added direct SEA build support with Node.js binary.
Added new stable APIs and utilities (require module handling, http.setGlobalProxyFromEnv, convertProcessSignalToExitCode, subpath imports with leading slash, V8.queryObjects)
Implemented multiple CVE fixes: added TLSSocket default error handler, network checks on pipe/wrap connect, stricter symlink read/write permissions, disabled futimes under permission model, rethrown stack overflow exceptions in async hoo...
Add TLSSocket default error handler (CVE‑2025‑59465) and route TLS callback exceptions through error handlers (CVE‑2026‑21637).
Imported from changelog source; review and generate a concise summary before publishing.
Fixed multiple CVE vulnerabilities (disabled futimes with permission model, added TLSSocket default error handler, required full read/write for symlink APIs, rethrown stack overflow in async hooks, removed zero‑fill toggle from unsafe bu...
Added new runtime options such as http.optimizeEmptyRequests, watch config namespace, portable compile‑cache flag, sqlite defensive flag, and inspector inspection ability
Updated crypto root certificates to NSS 3.114/3.116 and added security escalation and incident response documentation.
Reverts previous change that threw errors on localStorage access, restoring prior behavior
Added configurable options to util.deprecate and marked type‑stripping as a stable module feature.
Fixed Buffer.allocUnsafe to return uninitialized memory as documented, resolving a known issue.
Add http server option optimizeEmptyRequests, SQLite defensive flag, and watch config namespace; introduce optional disabling of source‑phase imports and experimental IsolateGroups support
Add passive listener spec compliance and extend SPrintF functions to accept std::string_view, enhancing API flexibility.
Node.js 24.x transitions to LTS (codename Krypton) with support through April 2028.
Added built‑in proxy support (CLI env proxy, HTTP/HTTPS request and Agent) and a new `shouldUpgradeCallback` for server‑controlled HTTP upgrades.
Upgrade to V8 14.1 adds faster JSON.stringify, built‑in Uint8Array base64/hex conversion, WebAssembly JSPI and other JIT optimizations.
Added per‑stream `inspectOptions` to the console API.
Add `shouldUpgradeCallback` to HTTP server API, enabling servers to control protocol upgrades and fixing related HTTP/2 upgrade handling.
Update bundled OpenSSL to 3.5.2, extending Node.js 22.x security support through 2027 and updating root certificates to NSS 3.114
Added Chrome DevTools network inspection for HTTP/2 calls in Node.js
Fixed a SHAKE128/256 crypto bug introduced by OpenSSL 3.4, restoring correct hashing behavior.
Introduce new CLI options (NODE_USE_SYSTEM_CA, ${pid} placeholder) and a threadCpuUsage API.
Added post‑quantum cryptography support (ML KEM, ML DSA) via new crypto.encapsulate/decapsulate methods and extended Web Crypto API with algorithms like AES‑OCB, ChaCha20‑Poly1305, SHA‑3, SHAKE, etc.
Add NODE_USE_SYSTEM_CA=1 flag to CLI for using system‑provided TLS root certificates.
Upgrade Node.js to ship OpenSSL 3.5.1, extending TLS support and security updates.
Enabled experimental type stripping by default, allowing Node.js to execute TypeScript files without extra configuration (can be disabled with --no-experimental-strip-types).
Fixed CVE‑2025‑27210: prevented Windows reserved device names (CON, PRN, AUX) from bypassing path.normalize() protection.
- Fixed CVE‑2025‑27210 by handling Windows reserved device names (CON, PRN, AUX) and tightening path.normalize() traversal protection.
Patched CVE-2025-27209: mitigated HashDoS in V8 by reverting recent rapidhash changes.
Added crypto.hash outputLength option for XOF functions and fixed SHAKE128/256 compatibility with OpenSSL 3.4.
Deprecate instantiating node:http classes without new, passing an empty string to options.shell, and HTTP/2 priority signaling; future versions may error or remove them.
Added async iterator handling for burst file system events and introduced the fileURLToPathBuffer API in the URL module.
Graduated WebCryptoAPI Ed25519 and X25519 algorithms to stable and added support for zero‑length HKDF/PBKDF2 and non‑byte‑aligned deriveBits in SubtleCrypto
Remove HTTP/2 priority signaling (breaking change) and deprecate related APIs
Added explicit Dir resource management and URL support for fs.glob's cwd option (SEMVER minor feature).
Graduated multiple experimental APIs to stable, including import.meta properties, top‑level Wasm, SQLite StatementSync.columns(), and default node.config.json support;
Fix error handling for async crypto operations to address CVE‑2025‑23166
Fix CVE-2025-23166 by correcting error handling on async crypto operations
Fixed error handling in async crypto operations (CVE‑2025‑23166).
Fix error handling on async crypto operations (CVE‑2025‑23166) – introduces breaking changes.
Reverted the SlowBuffer move to End‑of‑Life.
Upgrade to V8 13.6 and npm 11, bringing new language features (Float16Array, explicit resource management, RegExp.escape, WebAssembly Memory64, Error.isError) and performance/security improvements.
Enhanced the assertion library with partial error comparison, faster partialDeepStrictEqual, and exposed diff utilities.
Imported from changelog source; review and generate a concise summary before publishing.
Added partial error comparison and diff support to assert utilities, exposing a diff function for clearer assertion errors.
Upgrade OpenSSL to 3.0.16 and refresh root certificates to NSS 3.108, improving TLS security
Added experimental node.config.json support for default flag configuration in test runner and other features
Enabled require(esm) and module syntax detection by default, removing experimental flags and warnings (can be disabled with no‑experimental options).
- Added TLSA record query and parsing support in the dns module (new feature).
Updated crypto root certificates to NSS 3.107 and added OpenSSL 3.4 compatibility – security fix
Added support for using the system CA certificates store on macOS and Windows via a new flag in the crypto module
Imported from changelog source; review and generate a concise summary before publishing.
- ESM modules reach stability: import attributes and JSON module are now stable, plus fallback importer and import‑assertion fixes.
Updated crypto root certificates to NSS 3.107 and made prime generation/check interruptible, enhancing security
Fixed HTTP/2 memory leak on premature connection close and addressed ERR_PROTO issues (CVE‑2025‑23085).
Fix multiple CVEs: internal worker permission check (CVE‑2025‑23083), HTTP/2 memory leak and ERR_PROTO (CVE‑2025‑23085), and Windows path traversal in normalize() (CVE‑2025‑23084)
Throw on InternalWorker usage when permission model is enabled (CVE‑2025‑23083)
Added permission check that throws on InternalWorker usage when the permission model is enabled (CVE‑2025‑23083).
Permission model status upgraded from Active Development to Stable.
Enabled experimental strip types flag by default, allowing Node.js to execute TypeScript files via STDIN eval and worker eval input (experimental).
WebCrypto API Ed25519 and X25519 algorithms are now stable, eliminating ExperimentalWarning
Adds experimental `assert.partialDeepStrictEqual` for partial deep equality checks in tests.
Enabled experimental require(esm) by default in v22.x, removing ERR_REQUIRE_ESM and adding warnings/ERR_REQUIRE_ASYNC_MODULE handling;
Added a CLI flag to preserve environment variables during dr and enhanced util.getCallSites with sourcemap support; both are new features.
Added new benchmark suites (TypeScript, dotenv, ESM detection, ASCII file read) and improved existing benchmarks (deepEqual config, no‑warnings mode).
Mark import attributes and JSON modules as stable in ESM
Updated root certificates to NSS 3.104 (same as Firefox 131) to strengthen TLS security.
Node.js 22.x moves to Active LTS (codename 'Jod') with support through April 2027.
Buffer now correctly resizes when backed by a resizable ArrayBuffer
Introduce a new "module sync" exports condition for packages to provide a synchronous ES module when require(esm) is enabled, easing the CJS/ESM transition.
Enable require(esm) by default, making ESM loading the standard behavior
Added experimental network inspection support for http/https modules via a flag
Added util.getCallSite() API for retrieving the current execution stack trace.
Added `module.enableCompileCache()` API for on‑disk compile caching of modules, replacing the NODE_COMPILE_CACHE env var requirement.
Added experimental `--experimental-transform-types` flag enabling TypeScript‑only syntax (enums, namespaces) transformation and default module‑syntax detection for ambiguous .js files.
Adds experimental `require()` support for synchronous ESM modules, loading them as namespace objects when criteria are met.
Added experimental "strip types" flag for inline TypeScript type annotation removal, with import handling and file‑extension requirements;
Introduce process.getBuiltinModule(id) to synchronously load Node.js built‑in modules, bypassing require cache modifications.
Fix regression from 22.5.0 that caused V8 Object creation context crashes
Added new APIs such as http websockets exposure, path.matchesGlob, worker.postMessageToThread, and the node:sqlite module with ES‑module support flag;
Patched multiple security vulnerabilities (CVE‑2024‑36138, CVE‑2024‑27980, CVE‑2024‑22020, CVE‑2024‑22018, CVE‑2024‑36137, CVE‑2024‑37372) affecting network imports, permission model, and UNC path handling.
- Fixed multiple security vulnerabilities (CVE‑2024‑36138,‑27980,‑22020,‑22018,‑36137,‑37372) affecting network imports, permission model, UNC paths, and fs operations
Fixes CVE-2024-36138 and CVE-2024-27980 vulnerabilities
Added experimental Web Storage API, diagnostics channel events to module loading, and extended util.parseArgs with a `no` flag (new features).
Imported from changelog source; review and generate a concise summary before publishing.
Added new APIs such as Buffer.bytes(), process.getBuiltinModule(id), EventSource client, and enriched the test runner with snapshot testing, context.fullName, and module mocking support.
Async APIs now throw errors asynchronously, improving error handling.
Fix regression in http.server.close() that incorrectly closed idle connections
CLI now supports running WebAssembly with limited virtual memory and an option to disable the wasm trap handler
Revert the change that added npm PowerShell script installation on Windows to fix a regression.
Boosted base64/base64url encoding performance and added stack traces to fs/promises errors.
Introduced NODE_COMPILE_CACHE environment variable enabling automatic on‑disk V8 code caching for faster module reloads
Added require() for synchronous ESM graphs, enabled WebSocket client by default, new CLI `node run <script>` and built‑in glob/globSync APIs;
Fix CVE‑2024‑27980: command injection vulnerability in child_process.spawn on Windows
Fix CVE‑2024‑27980: command injection via child_process.spawn args on Windows
Fixed CVE‑2024‑27980 command injection in child_process.spawn on Windows
Fix high‑severity CVE‑2024‑27983 HTTP/2 server crash and medium‑severity CVE‑2024‑27982 request smuggling
Fixed high‑severity HTTP/2 server crash (CVE‑2024‑27983) by addressing an assertion failure in Http2Session
Fix critical HTTP/2 server crash (CVE‑2024‑27983) and medium‑severity request smuggling (CVE‑2024‑27982)
- Added crypto.hash() helper, new process.loadEnvFile/util.parseEnv helpers, and three new net connection attempt events.
Added import attributes to replace import assertions and deprecated the `assert` keyword; introduced `dirent.parentPath` replacing `dirent.path`.
Reverted change 51389 to restore t.after() hook execution on empty tests, fixing cleanup behavior
Add util.styleText for color and emphasis styling; new env utilities (process.loadEnvFile, util.parseEnv) with multiline .env support
Fixed multiple high‑severity vulnerabilities (CVE‑2024‑21892, 2024‑22019, 2024‑21896, 2024‑22017) and several medium‑severity issues.
Fixed multiple high‑severity security vulnerabilities (CVE‑2024‑21892, 22019, 21896, 22017, etc.) including code injection, privilege escalation, DoS, and path‑traversal bugs
Patched high and medium severity CVEs (CVE‑2024‑21892, 2024‑22019, 2023‑46809, 2024‑22025) by tightening crypto defaults and request size limits
Fixed a bug in undici when using WebStreams
Added three new net connection attempt events (connectionAttempt, connectionAttemptFailed, connectionAttemptTimeout) and fixed a bug that could trigger an assertion on failed attempts.
- Added new ESM capabilities including import.meta.dirname/filename, shadow‑realm module loader bootstrapping, and removal of the obsolete useCustomLoadersIfPresent flag.
Added simdjson support, moved the package resolver to C++ and introduced experimental feature flags for the Node API.
Fix regression in fs.writeFileSync when using 'utf8' encoding without a flag and the target file does not exist
Introduce a new "--disable-warning" flag allowing users to silence specific warning codes or types (e.g., DEP0025, DeprecationWarning).
Bundled npm upgraded to v10.2.3, providing npm 10 support across all release lines.
Added experimental flags --experimental-default-type and --experimental-detect-module to control default module behavior and auto‑detect ES module syntax for ambiguous files
Added import.meta.dirname and import.meta.filename to ESM; introduced new navigator properties (language, languages, platform) and a CLI flag to disable experimental global navigator
Node.js 20.x enters Active LTS (codename "Iron") until October 2024, then moves to Maintenance until April 2026.
Introduces experimental `--detect-module` flag to auto-detect and run ESM syntax in ambiguous .js or extensionless files, with plans to make it default later.
Node.js 21 ships with V8 11.8, stabilizes fetch and WebStreams, and adds a new experimental flag to default modules to ES‑M (default‑type)
Fixed multiple high‑severity CVEs (nghttp2, undici, path traversal, integrity check bypass, code injection) in version 20.8.1
Patched multiple CVEs (nghttp2, undici, integrity check bypass, Wasm export name injection) spanning high to low severity
Reverted libuv 1.45.0/1.46.0 updates introduced in Node 18.18.0 to fix regressions affecting Windows file handling and webpack thread loader
Stream API performance improved: writable/readable stream creation/destruction ~15% faster, webstream readable async iterator ~140% and pipeTo ~60% faster
Added ESM import flag, abortSignal listener support, autoSelectFamily getter/setter, and initial Symbol.dispose/asyncDispose implementations across core modules (fs, stream, dgram, net, etc.)
Added support for multiple .env file declarations and multiple allow‑fs flags for permissions.
Fix ESM loader to correctly load CommonJS modules
Add native .env file support for loading environment variables and NODE_OPTIONS via a CLI flag
Patched multiple high‑, medium‑ and low‑severity CVEs that bypass Node.js permission model (e.g., module load, process.binding, Buffer paths).
Fixed policy bypass CVEs (CVE‑2023‑32002, 32006, 32559) by tightening Module loading and process.binding handling
Fixed multiple policy bypass CVEs (2023‑32002, 2023‑32006, 2023‑32559)
Added abort‑signal safety APIs and abortable support (addAbortListener, asyncDispose, Symbol.dispose) across core modules like events, dgram, http2, net, stream, and timers (SEMVER minor).
Integrated Ada 2.0 as the new URL parser, delivering significant performance gains and eliminating the ICU requirement; added URL.canParse API.
Added MockTimers API to reliably mock setTimeout/setInterval across globals, node:timers, and node:timers/promises with time‑advancing controls
Fixed multiple high‑ and medium‑severity CVEs (CVE‑2023‑30581, ‑30585, ‑30588, ‑30589, ‑30590) and several c‑ares security issues
Fixed multiple high and medium severity CVEs affecting the experimental permission model, OpenSSL handling, and HTTP request processing
Fixed multiple CVEs (CVE‑2023‑30581, 30585, 30588, 30589, 30590) and several c‑ares vulnerabilities
Upgrade libuv to 1.45.0 with major Linux file‑system performance improvements and refresh many core dependencies (openssl, zlib, etc.).
- HTTP module now blocks writing to the response body when the HTTP spec disallows it (SEMVER MINOR).
Added several new FS, DNS, HTTP, and stream features (recursive readdir/opendir, cp mode flag, dns.getDefaultResultOrder, http.createServer highWaterMark, stream.compose object mode preservation).
- Adds experimental Permission Model, runs custom ESM loader hooks on a dedicated thread, makes import.meta.resolve() synchronous, and promotes the test runner module to stable.
Added initial support for compiling JavaScript into a single‑executable application.
Added high‑performance TracingChannel to diagnostics and introduced URL.canParse API for URL validation.
Updated core dependencies: undici to 5.20.0, c‑ares to 1.19.0, npm to 8.19.4, and corepack to 0.17.0.
Reverted the vm.compileFunction leak fix introduced in v19.8.0 that caused application crashes
Added new APIs such as Buffer.copyBytesFrom, AsyncLocalStorage.bind/snapshot, fs.openAsBlob, automatic DHE TLS support, URLSearchParams.size getter, WASI version parameter, and worker name visibility in inspector/trace events.
Added extensive test runner enhancements including built‑in reporters, initial code coverage support, describe.only/it.only shorthands, nested describes, improved diagnostics and async error handling.
Added abort handling APIs (aborted() utility, abort signals for streams) and expanded embedder snapshot capabilities, including per‑Isolate build snapshots and code‑generation policy control.
Upgrade npm to version 9.5.0 (and 9.4.0)
Fixed CVE‑2023‑23919, CVE‑2023‑23918, and CVE‑2023‑23920 addressing OpenSSL error handling, experimental policy bypass, and insecure ICU data loading
Fixed multiple CVEs affecting permissions policies, OpenSSL error handling, fetch API CRLF injection, and ICU data loading
Fixed multiple CVEs (permissions policy bypass, OpenSSL error handling, ICU data loading, fetch API CRLF injection, regex DoS)
Fixed CVE‑2023‑23918 (policy bypass via process.mainModule) and CVE‑2023‑23920 (ICU data loading) along with several other CVEs
Updated bundled npm to 9.3.1 with expanded Node engine support and removal of automatic file ownership handling.
Added ESM loader chaining support and a new "install strategy=linked" option; upgraded bundled npm to 9.4.0.
Added new crypto APIs (Symbol.toStringTag for CryptoKey/KeyObject, cipher validation, auth tag handling) and enhanced stream support with finished() for Readable/Writable streams and webstreams in Duplex.from()
Added new APIs: buffer.isUtf8 for UTF‑8 validation, os.availableParallelism(), and net.autoSelectFamily global getter/setter; improved HTTP timeout defaults handling and added a fast‑path for TextDecoder’s fatal flag.
Added support for externalizing JavaScript built‑ins (including WASM) in custom Node.js builds
Updated npm to 9.2.0, bringing many breaking changes originally introduced in npm 9.0.0 (engine support, filesystem permission handling, stricter auth config, separate login/adduser commands, defined tarball ignore order, and revamped ti...
Upgrade OpenSSL to 1.1.1s and refresh root certificates (add several new roots, remove old ones); update timezone data to 2022f with DST changes for Fiji and Mexico.
Updated OpenSSL to 1.1.1s and refreshed the root certificate store to NSS 3.85, adding new trusted CAs and removing obsolete ones
Updated timezone data to 2022f, fixing DST changes for Fiji and Mexico.
Added function mocking support to the built‑in node:test runner and introduced recursive file watching (fs.watch) on Linux via the recursive:true option.
Patched high‑severity CVE‑2022‑3602 and CVE‑2022‑3786 (X.509 email address buffer overflows) and medium‑severity CVE‑2022‑43548 (DNS rebinding).
Fixed high severity X.509 email address buffer overflow CVEs 2022‑3602 and 2022‑3786
Security release fixing CVE‑2022‑43548 (DNS rebinding via invalid octal IP address)
Patched CVE‑2022‑43548 (DNS rebinding via invalid octal IP address) in the inspector module.
Add OpenSSL shared configuration option across source, docs, and tests (SEMVER MAJOR)
Node.js 18.x enters Active LTS phase under the codename "Hydrogen"
HTTP/1.1 Keep‑Alive is enabled by default for client agents, improving throughput
Added experimental watch mode to the CLI, which restarts the process when imported files change.
Add new diagnostic and API features: callTracker getCalls/reset, ReadableByteStream.tee(), Set/Map maxArrayLength option, test runner hooks, and idle HTTP parser configurability.
Deprecate the weak MODP groups (modp1, modp2, modp5) in crypto APIs and documentation.
Fixed multiple security vulnerabilities (CVE-2022-32212, 32222, 32213, 32215, 35255, 35256) affecting DNS rebinding, OpenSSL config handling, and HTTP request smuggling
Fixed CVE-2022-32212 (DNS rebinding on macOS), CVE-2022-32213 (OBS fold bypass), CVE-2022-35255 (weak randomness in WebCrypto), and CVE-2022-35256 (HTTP request smuggling).
Fixed multiple CVEs: DNS rebinding on macOS (CVE‑2022‑32212), OBS fold bypass (CVE‑2022‑32213), and HTTP request smuggling (CVE‑2022‑35256).
Added diagnostics channel for process and worker, new OS.machine() method, and exposed Report and environment RequestInterrupt native APIs
Added runtime user‑land snapshots via build‑snapshot and snapshot‑blob APIs
Added experimental util.parseArgs helper and ESM loader hooks API with chaining support, expanding command‑line and module loading capabilities.
Added new CustomEvent API (global exposure via CLI flag) and drop request event for HTTP servers, plus token support in parseArgs
Added experimental ESM Loader Hooks API with support for chaining multiple custom loaders, enabling more flexible module loading.
Upgrade OpenSSL to 1.1.1q and add OpenSSL config appname, a major breaking change;
Added OpenSSL config appname and shared config option, introducing breaking changes (SEMVER MAJOR).
Upgrade OpenSSL to 1.1.1q and update related architecture files
- Crypto module: removed Node‑specific WebCrypto extensions and added support for CFRG curves and raw key imports.
Introduced new APIs: `util.parseArgs`, `http` uniqueHeaders option, optional parameters for fs write methods, and a TCP socket reset feature in `net`.
Updated bundled npm to version 8.11.0 (including incremental upgrades from 8.6.0 to 8.10.0).
Updated npm to 8.11.0 (with intermediate upgrades) and upgraded OpenSSL to 1.1.1o, including arch file updates
Updated OpenSSL to version 1.1.1o (not classified as a security release for Node.js 14).
Updated OpenSSL to 3.0.3 (incl. QUIC) – treated as a security release
Updated npm to v6.14.17 and added a new release key for Bryan English (docs).
Implemented the WebAssembly Web API and integrated it with lib/src, marking a new feature in the release.
Added experimental fetch API globals (fetch, Request, Response, Headers, FormData) and FormData support when enabled
Node.js 18 ships with V8 10.1, global fetch and Web Streams APIs enabled by default, and an experimental core test runner module.
Make authTagLength optional for AES‑GCM (CC20P1305) in the crypto API (SEMVER minor)
Final Node.js 12 LTS release; reaches End‑of‑Life on 30 Apr 2022, urging migration to Node 14/16.
Introduced HTTP client tracing via perf hooks (minor feature).
Updated OpenSSL to 3.0.2 (quic) addressing CVE‑2022‑0778 – a high severity infinite loop in BN mod sqrt when parsing certificates.
Updated OpenSSL to 1.1.1n, fixing high‑severity CVE‑2022‑0778 (infinite loop in BN mod sqrt when parsing certificates).
Upgrade OpenSSL to 1.1.1n, fixing CVE‑2022‑0778 (infinite loop in BN mod sqrt())
Updated OpenSSL to 1.1.1n, addressing high‑severity CVE‑2022‑0778 (infinite loop in BN mod sqrt).
Updated build scripts for new platforms (removed Windows 2022 runner, added Z/OS support, fixed Android ARM64 libuv) and upgraded npm to 8.5.0.
Fixed regression in url.resolve() affecting URLs containing '@' introduced in Node.js v17.7.0
Imported from changelog source; review and generate a concise summary before publishing.
Introduced several minor features: ESM flag for remote https/http fetch, fs.cp/cpSync now copy relative symlinks, FormData global when fetch is enabled, and readline Ctrl+6 redo binding.
Added experimental Fetch API globals (fetch, Request, Response, Headers) via a new flag.
Experimental import assertions are now required to import JSON modules (behind the experimental flag) and add stage‑3 proposal support.
Upgrade npm to 6.14.16.
Corepack is now bundled with Node.js, allowing Yarn and pnpm to be used without separate installation
Added new developer-facing APIs: child_process fork now accepts URLs, crypto now aliases webcrypto.subtle and getRandomValues, events now support captureRejections and include EventEmitterAsyncResource, loader can return package format, ...
Fixed improper handling of URI Subject Alternative Names to prevent certificate verification bypass (CVE‑2021‑44531).
Fix improper handling of URI Subject Alternative Names, disabling URI SAN checks to prevent certificate verification bypass (CVE‑2021‑44531).
Fix improper handling of URI Subject Alternative Names, preventing certificate verification bypass (CVE‑2021‑44531).
Fixed improper handling of URI SAN types, preventing certificate verification bypass (CVE‑2021‑44531).
Updated OpenSSL to 3.0.1 (quic) fixing CVE‑2021‑4044, improving security posture.
Updated c‑ares to 1.18.1 to resolve a regression with CNAME records containing underscores.
Upgraded npm to 8.1.2 and c‑ares to 1.18.1, fixing a regression with CNAME records containing underscores.
Expose async_wrap providers in async hooks and add reason property to AbortSignal
Updated c‑ares to 1.18.1, fixing a regression with CNAME records containing underscores.
Added JSON import assertion support to ES modules
Node.js 16.x transitions to Long Term Support (LTS) with codename “Gallium”.
Include missing V8 headers in the distribution to enable native addon builds.
Imported from changelog source; review and generate a concise summary before publishing.
Node 17 upgrades to OpenSSL 3.0 (with FIPS) and V8 9.5, tightening algorithm restrictions and introducing possible ERR_OSSL_EVP_UNSUPPORTED errors, a breaking security change.
Fix CVE-2021-22959: Reject HTTP headers with a space before the colon to prevent request smuggling.
Imported from changelog source; review and generate a concise summary before publishing.
Fixed HTTP request smuggling via spaced headers (CVE‑2021‑22959)
Updated root certificate bundle and fixed crypto edge cases (e.g., randomBytes callback handling, initEDRaw pkey failure).
Added new Buffer Blob support and base64url encoding; enhanced child_process APIs (URL cwd, spawn/exec timeout, cancellable exec, overlapped stdio flag) and added process worker event and source‑map enable APIs.
Added RSA‑PSS key generation parameters and multiple crypto fixes (default saltLength, MGF1 hash handling, key‑type validation) enhancing security;
Fix regression introduced by the V8 9.3 update in Node.js 16.9.0
Integrated Corepack into Node.js, enabling use of Yarn and pnpm without separate installation.
Security patch addressing multiple CVEs (2021‑32803, 2021‑32804, 2021‑37701, 2021‑37712, 2021‑37713, 2021‑39134, 2021‑39135) in node‑tar, arborist, and npm CLI.
Fixed multiple CVEs (2021‑32803, 2021‑32804, 2021‑37701, 2021‑37712, 2021‑37713, 2021‑39134, 2021‑39135) in node‑tar, npm‑arborist, and npm CLI
Added new stream utilities: Duplex.from constructor, isDisturbed helper, and duplexify support;
Added experimental recursive `fs.cp` method, new `dns` "tries" option, `crypto.randomUUID`, and `URL.createObjectURL` APIs.
Fix CVE-2021-22931: add proper handling of atypical characters in DNS hostnames to prevent remote code execution, XSS, and domain hijacking.
Fixed high‑severity CVE‑2021‑22931: added proper validation of atypical characters in DNS hostnames to prevent RCE, XSS and domain hijacking.
Fixed CVE‑2021‑22931: added strict hostname validation in DNS library to prevent RCE, XSS and domain‑hijacking risks.
- Updated npm to 7.20.3 and reverted a V8 9.2 ABI breaking change that could affect native modules
Upgrade V8 to 9.2 adding Array.prototype.at (including TypedArrays and strings)
Security release addressing CVE‑2021‑22930 (use‑after‑free in http2 stream canceling).
Patched high‑severity CVE‑2021‑22930 (use‑after‑free in http2 stream cancel handling).
Added an experimental Web Streams API implementation accessed via the new `stream/web` module (emits a process‑wide experimental warning).
Fix regression in Windows installer on non‑English locales
Fix regression in Windows MSI installer on non‑English locales introduced in 12.22.2
Fixed regression in Windows installer for non‑English locales introduced in Node.js 16.4.1
Fix out-of-bounds read vulnerability in libuv (CVE‑2021‑22918)
Patched libuv to fix an out-of-bounds read vulnerability (CVE‑2021‑22918) affecting Node's dns.lookup().
Upgraded libuv to fix CVE‑2021‑22918 out‑of‑bounds read in DNS lookup.
Stabilized AsyncLocalStorage and added support for URL‑based cwd in child_process; introduced CLI flag negation and new debugger error codes
Updated ICU to 69.1 and incorporated several V8 cherry‑picks, refreshing core dependencies.
CLI adds the -C alias for the --conditions flag.
Added async hooks support for new V8 PromiseHook API and introduced 'worker' event in process module.
- Added a new API allowing fsPromises.fileHandle.read() to be called with no parameters (feature, minor).
Removed many legacy APIs: permissive fs.rmdir recursive option, module.createRequireFromPath, Python 2 support, and several process.binding internals, causing breaking changes;
- Fixed high‑severity OpenSSL vulnerabilities (CVE‑2021‑3450, CVE‑2021‑3449) and npm y18n prototype‑pollution issue (CVE‑2020‑7774) across all 15.x, 14.x, 12.x, and 10.x releases.
Fix high‑severity OpenSSL CVE‑2021‑3450 and CVE‑2021‑3449 by upgrading OpenSSL to 1.1.1k
Patched OpenSSL CVE-2021-3450 (CA certificate check bypass) and CVE-2021-3449 (NULL pointer deref).
Patched high‑severity OpenSSL vulnerabilities (CVE‑2021‑3450, CVE‑2021‑3449) and npm y18n prototype‑pollution issue (CVE‑2020‑7774).
Added Buffer btoa/atob functions, http.ClientRequest.getRawHeaderNames(), child_process spawn/fork timeout options, and stream.pipeline Buffer support; performance and AbortController improvements were also introduced.
Imported from changelog source; review and generate a concise summary before publishing.
Imported from changelog source; review and generate a concise summary before publishing.
Enabled FIPS-related crypto options by default and refactored crypto internals to avoid unsafe array iteration.
Fixed multiple high‑severity vulnerabilities (CVE‑2021‑22883, CVE‑2021‑22884, CVE‑2021‑23840) in HTTP/2, inspector DNS rebinding, and OpenSSL integer overflow.
Fix CVE‑2021‑22883: HTTP/2 unknownProtocol DoS via resource exhaustion
Patched CVE‑2021‑22883 (HTTP/2 unknownProtocol DoS), CVE‑2021‑22884 (inspector DNS rebinding), and CVE‑2021‑23840 (OpenSSL integer overflow).
Patched CVE-2021-22883, CVE-2021-22884, and CVE-2021-23840 to prevent denial‑of‑service and OpenSSL overflow issues.
Added JWK export support to Crypto KeyObject and new TLS X509Certificate getters, plus async iteration for timers and fsPromises.watch() with AbortSignal support.
Upgrade npm to version 6.14.11
Fixed crash in crypto module when calling digest after piping.
Upgrade npm to 6.14.11 and backport V8 changes.
Added crypto APIs: generatePrime/checkPrime and experimental Ed25519/Ed448 key support.
Synchronize release keys with the main branch
Added Blob support to Buffer and a new base64url encoding option
Add overlapped stdio flag for child processes and support AbortSignal in fork and server.listen
Imported from changelog source; review and generate a concise summary before publishing.
Fix use‑after‑free in TLSWrap (CVE‑2020‑8265)
Fixed high‑severity OpenSSL and TLS vulnerabilities (CVE‑2020‑1971, CVE‑2020‑8265).
Fixed high‑severity use‑after‑free bug in TLSWrap (CVE‑2020‑8265) preventing potential DoS or memory corruption.