Node.js Ships Two Releases on the Same Day, Adds Native throttle, debounce, and PKCS12 Parsing
A new Current line and a surprise feature-packed LTS both landed today. The LTS one is carrying more than most point releases ever do.
Node.js got two point releases on the same calendar day. Today, maintainer Richard Lau shipped Node.js 26.12.0 to the Current line and Node.js 24.22.0 to the active "Krypton" LTS. Both came out of the same build window. That kind of double-drop tends to happen when you run two release tracks and they decide to touch base at once. The LTS build, though, is doing more than you'd expect.
Node.js runs on Chrome's V8 engine. It powers everything from backend APIs to command-line tools, and it lives under the OpenJS Foundation. The schedule is time-based, so developers know roughly when updates arrive. LTS lines are the stable ones teams lean on in production. Current lines get the newest features, along with the newest chances to break. Normally only one moves at a time. Not this week.
Node 26.12.0 is leaner than usual. Two headline additions, then a big batch of performance and correctness work. First, James M Snell added websocketMask() and websocketUnmask() to node:http (PR #66335). Those helpers apply and reverse the XOR masking that RFC 6455 requires for client-to-server WebSocket frames. Node has always done this work internally, so exposing it as a primitive mostly helps library authors building custom transports or proxies. It's a building block, not something your chat app needs.
Then there's a change that throws early and explicitly when WebAssembly or RX support is missing (PR #66533, Paolo Insogna). Small courtesy, sure. But a clear message at the point of use beats a vague error a hundred lines later, and debugging is half the battle.
Here's where it gets interesting. Geoffrey Booth's effort on PR #62530 keeps chipping away at letting you require() ES modules synchronously. For years, CommonJS loaded things in order and blocking, while ES modules ran async. That mismatch has annoyed people for a long time. Joyee Cheung wrote a widely shared piece on the very idea of require(esm) a while back, and the thread still gets attention today.
This cycle doesn't finish the job. It just lets the majority of ESM files load synchronously. Momentum, not completion. But you can watch the shape of it now.
Other items in 26.12.0: process.finalization moved to release candidate (PR #66436, Matteo Collina), config files got marked stable (PR #66431, Marco Ippolito), and streams picked up dump() and dumpSync() helpers for capturing output in tests (PR #65598, Ethan Arrowood). Deps landed too, including SQLite 3.54.0 and acorn 8.19.0. Python 3.15 build support is there as well, which is a future-looking detail worth flagging for anyone on the packaging side.
The LTS line is the one most teams will actually care about
Node 24.22.0 is the release that matters for production. The release notes call out roughly 13 SEMVER-MINOR additions, and a big chunk of it is crypto. Filip Skokan did most of the heavy lifting, with four changes forming the core.
First, a new crypto.parsePKCS12() parser (PR #65627, Brian Muenzenmeyer) handles those .p12 and .pfx files that bundle certificates and private keys together. That gap has been around long enough to qualify as a classic. A generic MAC API (PR #65553) then rounds out the HMAC support.
Skokan also made getCiphers() and getHashes() report what the loaded OpenSSL provider actually exposes (PR #65484). That matters if you run custom or FIPS-enabled providers, since capability detection goes quietly wrong the other way. On top of that, SIV and GCM-SIV modes got enabled (PR #63411), keeping predictable IVs safe for disk or database encryption without the nonce-reuse pitfalls of naive CTR/GCM.
Not into crypto? There's plenty else. Guy Bedford let a pre-bound socket be handed to worker threads and child processes (PR #64725), which is a real convenience for servers that want to bind a port once and fan the work out. perf_hooks gained a SlidingWindowHistogram, a confidence-interval meanCI method, and CBOR export for shoving histograms between processes. SQLite's synchronous statements got a proper close() plus [Symbol.dispose]() (PR #64232), so you can lean on the using keyword instead of leaking handles.
And then the utility functions you've probably been reaching for a third-party package to get. util.throttle() and util.debounce() finally ship natively (PR #65899), trimming one dependency off the frontend-ish logic that runs on the server these days. A companion change adds util.markPromiseAsHandled() (PR #65805) for silencing unhandled-rejection warnings when you handle a promise a bit later.
It's a lot, and the honest read is that this LTS point release is doing more than a point release usually does. That's not inherently bad. These are all backward-compatible additions, so moving off an earlier 24.x is generally low risk. You should still test against your own workload, as always.
A large share of commits across both lines is unglamorous but real work: use-after-free fixes, null-pointer guards, memory-safety corrections around things like Hmac.digest(). The crypto-heavy Krypton line is also quietly signaling that provider-aware, FIPS-leaning support is a priority for security-sensitive workloads.
As of right now, 26.x is still the Current track and 24.x is the LTS you can actually deploy. Plan the upgrade to 24.22.0 if you're on the LTS line and want the new crypto primitives and native utilities. If you're on Current, the WebSocket masks and earlier error signals are the main draws.
Install or switch versions through nvm:
nvm install 26.12.0 # Current line nvm install 24.22.0 # LTS "Krypton" node --version
Head here to direct download links.
