Node.js 26.3.0 (Current)

Antoine du Hamel

2026-06-01, Version 26.3.0 (Current), @aduh95

Notable Changes

Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in #63055.

Other notable changes

[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672

Commits

[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
[0eff3e23b9] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
[447ab2d252] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
[86032758e4] - build,win: replace LTCG with Thin LTO for releases (Stefan Stojanovic) #63114
[5f4d794052] - build,win: add Rust toolchain automated configuration Windows (Mike McCready) #63381
[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
[d0f65e3579] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
[e3ddb326c9] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
[e04cd17dc0] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
[64ba74d847] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
[bd230418b4] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
[1a4090a83d] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
[dbc78ff825] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
[4da442f432] - deps: upgrade npm to 11.16.0 (npm team) #63602
[63372cfa87] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
[e286fa170d] - deps: upgrade npm to 11.15.0 (npm team) #63463
[de996437a5] - doc: downgrade macOS x64 to Tier 2 (Antoine du Hamel) #63055
[22ac78750c] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
[532f7f2085] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
[c61f90dfb9] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
[fd69d7b16a] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
[693257782c] - doc: generate llms.txt (Guilherme Araújo) #62027
[55a57beb26] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
[4895c2babc] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
[0355c36e37] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
[c85ee22df6] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511
[62947192f6] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
[9849690a1d] - doc: edit Rust toolchain general install instructions (Antoine du Hamel) #63488
[885d2462e9] - doc: fix double space in modules.md (Daijiro Wachi) #63512
[42fbb48bc6] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
[05a7b0a301] - doc: add Rust toolchain general install instructions (Mike McCready) #63426
[e13dfd7ed0] - doc: update toolchain for official releases (Richard Lau) #63441
[82306881cc] - doc: fix typo in deprecations (Daijiro Wachi) #63434
[eeb77d217c] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
[679e13c57f] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
[7f41f5d803] - ffi: validate 'void' as parameter type in getFunction and getFunctions (Anshika Jain) #63504
[972cd227cb] - ffi: remove function signature property aliases (René) #63482
[5d7805e433] - ffi: move DynamicLibrary disposer to native layer (René) #63459
[5a0b32dc24] - gyp: update deps gypfiles (Nad Alaba) #63117
[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
[e3c6629ee3] - http2: emit session close before stream close (Matteo Collina) #63414
[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
[6bef10e7b7] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
[fdc0b3d49c] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
[99baf27aeb] - lib: fix typos in esm loader comments (RonGamzu) #63465
[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
[8e75efb9bc] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
[a4ae97045f] - meta: label "source maps" PRs (Chengzhong Wu) #63591
[3455a48ae1] - meta: add vfs subsystem label (René) #62331
[01bfcdfc20] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
[bc4c457eae] - meta: add additional gitignore entries (James M Snell) #63267
[e1d65d9509] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
[6a97b0932a] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198
[5989f4a6e1] - quic: support hostname verification (James M Snell) #63483
[b4d30e7a78] - quic: add stream idle timeout (James M Snell) #63483
[8a1017f774] - quic: add block list support for endpoints (James M Snell) #63483
[5a3ab93c49] - quic: improve peer cert verification (James M Snell) #63483
[9701a82a78] - quic: handle h3 max header size option (James M Snell) #63483
[71788a2048] - quic: add rate limiting docs (James M Snell) #63483
[309bd49906] - quic: cache timestamp for address lru cache (James M Snell) #63483
[2ce5588d51] - quic: add session creation rate limiting (James M Snell) #63483
[98808baed1] - quic: refine rate limiting (James M Snell) #63483
[75a4176b32] - quic: flip preferred address policy default to 'ignore' (James M Snell) #63483
[8b6b03d60c] - quic: add doc note about certificate size limitations (James M Snell) #63483
[30eff873e0] - quic: add applicationOptions to session (James M Snell) #63267
[4303daa43c] - quic: add getters for local and remote transport parameters (James M Snell) #63267
[e1b1bb5465] - quic: improve recv coalescing test sizes (James M Snell) #63267
[25a416f457] - quic: add initial RTT option to session options (James M Snell) #63267
[22e91c357f] - quic: enable recvmmsg batching in Endpoint (James M Snell) #63267
[c96d8a9d9b] - quic: improve stream header collection performance (James M Snell) #63267
[409460f2ce] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
[9a2afffec9] - quic: coalesce received data into fewer buffers (James M Snell) #63267
[f9a6a2f558] - quic: apply multiple additional minor improvements (James M Snell) #63267
[ea5f3724ee] - quic: fix tests that are missing serverEndpoint close (James M Snell) #63267
[6cffc931fc] - quic: fixup some v8:: qualifiers (James M Snell) #63267
[9bc875e522] - quic: fix premature unref of endpoint when listening (James M Snell) #63267
[f940d6b1be] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) #63267
[fd00e0acb0] - quic: fix UAF in Application::OnTimeout() (James M Snell) #63267
[378dbf00e9] - quic: improve the quic js structure (James M Snell) #63267
[0045dc30b6] - quic: improve internal structure of QuicStream (James M Snell) #63267
[5e38946b26] - quic: add aliased struct arenas (James M Snell) #63267
[95430437a0] - quic: add handshake timeout and default connection limits (James M Snell) #63267
[5622701429] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
[b171f391cd] - quic: fixup linting issue after other changes (James M Snell) #63267
[24e9f4f177] - quic: fix crash in early handshake failure (James M Snell) #63267
[5025e85d0a] - quic: eliminate per-received datagram allocation (James M Snell) #63267
[aec1e17ec5] - quic: cache the timestamp on send and receive (James M Snell) #63267
[9560084560] - quic: add support for future ECN marking (James M Snell) #63267
[2b3ff8ada2] - quic: improve batching of packet sending (James M Snell) #63267
[fe3639a4d6] - quic: improve backend quic packet processing (James M Snell) #63267
[f043013d9a] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
[343958224d] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
[2906fa833d] - src: dispatch ToV8Value(string_view) via StringBytes::Encode (Mert Can Altin) #63370
[860f9d8d4b] - src: fix ContextifyContext property definer interception result (Chengzhong Wu) #63549
[fcccffcbe6] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529
[55f65f9fb6] - src: improve token return value check (James M Snell) #63483
[7a36ca46cd] - src: expose node::RegisterContext to make a node managed context (Chengzhong Wu) #62322
[9bda92963c] - src,sqlite: only pass xFilter when user provided a callback (Antoine du Hamel) #63516
[563db50f38] - stream: switch to internal sleep binding (Antoine du Hamel) #63611
[a6e2322ee6] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593
[7198895c6b] - stream: serialize concurrent share consumer reads (Trivikram Kamat) #63478
[70ba8be1d7] - stream: fix lint error (Antoine du Hamel) #63598
[1608d905a7] - stream: reject pending reads on iterator throw (Trivikram Kamat) #63555
[dc12b730d8] - stream: wait for push writer end fallback to drain (Trivikram Kamat) #63503
[4f40a85a1a] - stream: flush each fused stateless transform (Trivikram Kamat) #63468
[526e0fc427] - stream: avoid duplicate writes in toWritable (Trivikram Kamat) #63360
[0008d01f9c] - stream: propagate abort reason in share and broadcast (Trivikram Kamat) #63358
[217338e18b] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #61197
[381f4b1b10] - stream: disallow writing string chunk with 'buffer' encoding (René) #63062
[cbee0de1cb] - stream: align Readable.toWeb termination with eos (ikeyan) #62394
[be91f0a927] - test: shorten path in net pipe connect errors (Matteo Collina) #63405
[83cada8bcc] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #63547
[3560b96a10] - test: deflake test-webcrypto-crypto-job-mode (Filip Skokan) #63543
[0c9c52373a] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469
[12052dbe14] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520
[8c479f274a] - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131 (Node.js GitHub Bot) #63373
[2ca32a5ee8] - test: update WPT for url to e4a4672e9e (Node.js GitHub Bot) #63372
[1bf875bd21] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396
[97dbfa09f7] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392
[8b038d7b33] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390
[f504c01d66] - test: get rid of unnecessary AbortController instanciations (Antoine du Hamel) #63489
[170585ff90] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449
[935468a49e] - test: fixup quic tests (James M Snell) #63267
[fbbdfdcfc7] - test: wait for ok before initial break after restart (Yuya Inoue) #62807
[db808ad77d] - test: unskip snapshot reproducibility test (Joyee Cheung) #63307
[259d8b3dce] - test: update WPT for WebCryptoAPI to 97bbc7247a (Node.js GitHub Bot) #63417
[d56c6cd708] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #63510
[16015f1565] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #63533
[003b9ccbe9] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432
[fdc4b5aed4] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431
[6a0bd2f329] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435
[a646c93254] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429
[b1fa59cbb6] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429
[6ac7ff24ac] - tools: refine v8.nix source definition (Antoine du Hamel) #63625
[59c01b959f] - tools: add lint rule for aborted AbortController (Trivikram Kamat) #63541
[2ab034f6f9] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63494
[a6af903e0a] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #63415
[215cd543dd] - tools: skip commit-lint on backport pull requests (Marco) #63378
[0479f28e95] - tools: fix skip of test-internet on forks (Antoine du Hamel) #63492
[69dfadf785] - tools: mock some Python utils in v8.nix to reuse builds (Antoine du Hamel) #63454
[7b3e222cda] - util: remove unused functions (Antoine du Hamel) #63612
[5a1f67c27b] - util: create hex style cache and fast path (Guilherme Araújo) #62999

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

479341ad9a1030ee39d64d192e7b30c719f680d096f8b48f0cf512f240fc3285  node-v26.3.0-aix-ppc64.tar.gz
77ef7f7a15aa757c2ca19d63cf41c8d9eb3b18590ebc6883871310787d8c6b6c  node-v26.3.0-darwin-arm64.tar.gz
cc1e06417e62351b90c9ed5721c98aeb235cdc0248e292c13975f77fbf61657c  node-v26.3.0-darwin-arm64.tar.xz
7453bd54a17bdc656e2e784d702f6eeb224fb517965e6f8c5a31a88c83d3804c  node-v26.3.0-darwin-x64.tar.gz
2c87425a25ff3e2597a1e6bc2aeb3b3c20ed18dbf58f5f350ad2ed3b8c443b2d  node-v26.3.0-darwin-x64.tar.xz
fca113c5d5add8bfb1aa31129a24acb8d49aa69ab3c22a2cc569aec88960526d  node-v26.3.0-headers.tar.gz
e44c57bdfbc9ec8ece1ae2c8763accb658480276003d7b0d8f1404e990d35f15  node-v26.3.0-headers.tar.xz
b2e01f65905c24cb5dd19c4cfbfefe0118e0504c170cc18beac343a2abbb59bd  node-v26.3.0-linux-arm64.tar.gz
392f291d00c74644f35ec0325cd03d9d4f5a627c926213fbd05167c0cba9f977  node-v26.3.0-linux-arm64.tar.xz
0e6cc9a223539be027378865d959aee55bf8e941c9bf690b2082b78bfcc0e4ef  node-v26.3.0-linux-ppc64le.tar.gz
615c60e210abaaa0f648b76e73b65acbc778189605b182cd6f6b4463357ef2e4  node-v26.3.0-linux-ppc64le.tar.xz
b1880e13a957430f454cb82ba987fcaf82cc4413c742827c04bb5ec20799d426  node-v26.3.0-linux-s390x.tar.gz
5fde5229103a12ede2c80e9f85aae18b91b5f90baa2ad70ef944db17e6f20bc8  node-v26.3.0-linux-s390x.tar.xz
a6e65cc653e40c1653b77742f9185dbce3ff1f99fa2746d211bddb53530ef206  node-v26.3.0-linux-x64.tar.gz
0ce210831380ab75a5fec0d3fb6b5af0958898016b2cae51cc2fa11057d2f77e  node-v26.3.0-linux-x64.tar.xz
3a5193f4b489a4f8e70e74a8021d43219bb156379db33d32e52de2c343fe244a  node-v26.3.0-win-arm64.7z
18c5014722e1debdb3e693501043a087485e6f1277b20c79c5ec86bce6027ee0  node-v26.3.0-win-arm64.zip
7ea5895da86ad776075afe84ad07908ae73a0b9f039514f9d0dedd12e76cfb63  node-v26.3.0-win-x64.7z
ec6d0f6b056c89498a9b26c4d5c77a31fd0b7fe45ba8a45fa87d26f66c3ebce4  node-v26.3.0-win-x64.zip
6281387dd8c022fd3191de23904587815c3fac3e6f91b7d36538d889c4c6f6a2  node-v26.3.0-x64.msi
0eefec8d427dd5d4e282660344ee5b482e8bf5b09d13fd572f456d0da47217e0  node-v26.3.0.pkg
a3350c1adda81e921c1dae03cbdf0547c29b5ec43b5e00ac66f043a5c76bc74c  node-v26.3.0.tar.gz
319ad5d7d20cc622e55eb75b9f1a2546b77a08bd462b67030d0c89316c2c2349  node-v26.3.0.tar.xz
11efc27fb91247b997a095df43548d8fa59f2d1e18dbb00f98bfeb8e5b0945be  win-arm64/node.exe
bd474f1ca8c44b2ab10e908c14447c5d91e1bac3f3a4d3141c78b6dbb5d1a253  win-arm64/node.lib
9dda9a1cd35592d840e16d064d0493e65d7ef8ec1271c259dd6cf2181a5a3e72  win-arm64/node_pdb.7z
80ecd178199b8f8c3f96567877050e076abb56983832d937d182e85920c73e29  win-arm64/node_pdb.zip
35d366f67382f0ba791dcabeded8f6a6d5c77efee4d833f38c1dd3a1e6f160f8  win-x64/node.exe
2f71186cc7649a7406b1616566700e397e9dd52bd7267440d78d78a1725bd312  win-x64/node.lib
4559c8140af9c801b8d7b31e0f3085e716aa9a58ef792336ef15d328aed81cbb  win-x64/node_pdb.7z
3e1e578d2f5d8ae4a099672a82e959eddf1794b5b833218189a266ab210597f0  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCah3CpQAKCRAgsaOQsWjT
VoYvAQD851IDZjItzaokWrmw1bjU8kC7jfhGaFz3XhNd/tPwhQEApPGL1cHuSz0o
5bVP/CQ5IlGklE4kwMwi4nLnps4QKww=
=9Vh/
-----END PGP SIGNATURE-----

Node.js 24.16.0 (LTS)