Node.js v24.19.0 and v26.6.0 landed on August 3, 2026, delivering security and performance updates to the LTS and Current branches. The v26 release restructures the internal crypto module into three distinct backends and overhauls streams performance with ring buffers and reduced allocations. v24.19.0 LTS gains blockList release candidate status, stable stream.compose, and TLS improvements including certificate compression and negotiated group reporting. The new versions also introduce enhanced test runner logging, FFI event loop awareness, and hardware-accelerated crypto for RISC-V platforms.

Node.js 24.19.0 and 26.6.0 land, introduce crypto backend split and major stream optimizations

The Node.js project shipped two new versions on August 3, 2026. v24.19.0 continues the Krypton LTS line, adding blockList release candidate status and TLS hardening. v26.6.0 enters the Current cycle with an architectural overhaul that splits the crypto module into three distinct backends and slaps a massive performance patch on streams.

Both versions were shepherded by Antoine du Hamel. The LTS branch has been in maintenance mode since May 2025. v26 Current entered its current phase in May 2026. You can grab the tarballs from the Node.js website or run nvm install 24.19.0 and nvm install 26.6.0 to update right now.

Crypto backend split and streams overhaul

The headline for v26 is internal. The crypto module has been restructured into three separate backends: OpenSSL 3.x, BoringSSL (the Chromium variant), and a legacy OpenSSL layer. This lets the team optimize per platform without a shared codebase bottleneck.

It's a rather aggressive restructure, though the average developer won't see a functional difference. However, at the same time, having separate code paths for BoringSSL and OpenSSL simplifies the maintenance burden significantly. The v26 release notes mention fixes for RSA-PSS public key DER preservation, private key memory cleansing, and incomplete private key handling. KangarooTwelve customization parameters are now capped at 512 bytes.

The streams implementation also got a heavy polish. Matteo Collina and the team have ripped out linked-list allocations on hot paths. You get ring buffers for request queues, sync iterator preferences in fromSync, and budget-based backpressure for iterable streams. Speedups hit async iteration over byte streams and default WHATWG readers.

If you're building network servers, net.Server and net.Socket are now transferable across worker threads. Combine that with synchronous connect support for BoundSocket, and you can migrate connections between workers without re-binding.

The experimental FFI module gains getCurrentEventLoop(). This is critical for correctness when making native callouts from worker threads or async resource tracking scopes. FFI users should migrate to this API to ensure callbacks fire in the right execution context.

Node.js — Node.js 26.6.0 (Current)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 26.6.0 (Current)

v24 LTS: Stability and security

v24.19.0 takes a more conservative tack. blockList has been promoted to release candidate, signaling the DNS API is nearing final stabilization. Keep in mind that the interface is finalized but may still shift slightly before full LTS stability.

stream.compose is now stable. Production code can rely on it without experimental flags. ReadableStreamTee is also exposed on stream/web, enabling fan-out patterns where a single readable stream splits into two independent consumers.

TLS gets tlsConnection.negotiatedGroup, which reports the actual key exchange group negotiated during the handshake. Certificate compression via RFC 8879 is supported, reducing handshake payload sizes for bandwidth-constrained networks.

Security hardening includes EdDSA signature verification rejecting small-order points, closing a potential key recovery vector. Large DH generator validation is fixed for non-standard generators. Inspector socket write-to-closed issues that caused crashes in debugging sessions are resolved.

Node.js — Node.js 24.19.0 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 24.19.0 (LTS)

Test runner, web standards, and deps

The built-in test runner continues its rapid maturation. v26 adds test_runner.context.log() for structured logging and a test:log event for custom reporters. Every TestStream event now includes an entryFile field for per-event granularity. v24 adds tag-based filtering in the test runner.

Web standards alignment keeps pushing browser API parity. buffer.textStream() implements Blob.prototype.textStream(), filling a gap in the Blob API for streaming text extraction without materializing the full string in memory. An ESM --experimental-import-text flag lets import statements load raw text resources at build time.

perf_hooks gains EventLoopDelayObserver for sampling delay between event loop iterations. Useful for detecting sync tasks blocking the event loop. net.Socket.setKeepAlive() now supports TCP_KEEPINTVL and TCP_KEEPCNT for precise TCP keepalive tuning.

Dependency updates cover the usual suspects. npm jumps to 11.17.0 on v24 and 11.18.0 on v26. V8 receives backported fixes including WASM trap handler improvements and temporal C-API integration work. v26 enables hardware-accelerated crypto on RISC-V platforms via new asm support.

No breaking changes in the notable updates. All additions are SEMVER-MINOR or stability improvements. The httpValidation option requires explicit opt-in; default behavior is unchanged.