Node.js 26.10.0 ships with util.debounce(), util.throttle(), and crypto.parsePKCS12()
The latest Current release rounds out several long-requested APIs, most of them utilities developers have reached for third-party packages to get.
Node.js 26.10.0 reached the Current development line today. Antoine du Hamel put it out. Despite a long changelog, the genuinely useful bits cluster in a few spots, and the rest is the usual tide of correctness fixes, performance tweaks, and test hardening.
The parts that actually matter
The biggest story here is util.debounce() and util.throttle(). These are the helpers most people already vendorized into their node_modules. Now they live in the util module, built in, no install required.
James M Snell landed both in a single PR (#65899), and his release-note comment reads more like a holiday side project than a formal contribution. He said he'd been leaning on an npm dependency until he realized how generally useful it is to have the thing "Just There."
Keep in mind that the design wasn't settled on the first pass. Contributors ljharb and bakkot raised questions about using an AbortSignal, which only ever flips to "aborted" once, inside a function you'd call repeatedly. Snell went back and made the signal cancel every future invocation, then added a leading-edge option so the first call fires right away.
Matteo Collina signed off, noting he uses these utilities in "essentially every app." For what it's worth, that's a fair bar. debounce and throttle are small, boring, and everywhere. Having them in core just means one fewer dependency to keep updated.
Snell's PR also carried util.markPromiseAsHandled(), an explicit way for framework authors to tell the runtime a promise was handled. Not a headline feature, but unhandled-rejection signaling is a surprisingly common source of confusion.
crypto.parsePKCS12() closes a gap that's bothered people for years. Pulling a private key or cert out of a .p12 or .pfx bundle meant either shelling out to openssl or dropping in node-forge. Node already did the parsing internally for TLS's pfx option; it just never surfaced the result to JavaScript.
The new API wraps OpenSSL's d2i_PKCS12_bio() and PKCS12_parse(). You pass in a buffer and a passphrase, then get back an object with privateKey, certificate, and additionalCertificates. There's a real-world reason it exists at all: loading client identity files for MCP tool calls, in search of "real identity instead of service account." It was Brian Muenzenmeyer's first significant core contribution touching C++, refined with Filip Skokan. He also kept the distinction between absent and empty passphrases, since OpenSSL treats them differently.
The experimental Virtual File System keeps eating more of Node. Matteo Collina and Philipp Dunkel pushed node:ffi to load libraries straight from a mounted VFS, using the same trick native addons already use: handing bytes to process.dlopen() from a private, self-cleaning anonymous memfd on Linux. While a VFS is mounted, a library reader slots into ffi and pulls from that same image type. The PR also fixed a bug where the dlopen hook forwarded an undefined flags argument, which silently broke loading addons from the real filesystem too.
A handful of smaller but solid additions round out the section. fs.openAsBlobSync() gives you a synchronous path to file-backed Blobs. net.BoundSocket is now transferable to worker threads and child processes, which dodges port-bind races. And sqlite binding undefined to NULL means query builders like Knex stop having to sanitize their bindings by hand.
Not just fixes
There's a lot under the surface. Crypto gets RSA-PSS restriction handling, PBKDF2 iteration-limit checks, and optimized private-key JWK imports. fs gets cpSync honoring dereference for nested symlinks plus working file removal on Windows. net/http2/stream stops destroying sockets mid-request. The inspector no longer crashes when V8 platform data is missing, and it seeds V8 from the OS CSPRNG instead of OpenSSL's DRBG.
A long list, but most of it is exactly what you want in a release: things that used to break now don't.
Node.js 26.10.0 is available now in the Current line. Downloads span Windows and macOS installers, Linux musl and glibc builds, ARM64, PPC LE, s390x, and AIX, plus source code and headers.
The one caveat: this is a Current line, not LTS. So you're getting the latest APIs rather than frozen stability. Fine if you want the newest stuff. Not fine if you'd rather not upgrade every few weeks.
Head here for the download page.
