Node.js 26.7.0 Ships with Heavy Crypto Hardening and Native Tracing
The Current track picks up STORE loader key support, an NSS root store refresh, and experimental promise-based networking.
Node.js 26.7.0 landed today, and if your server-side workloads touch cryptography, this is the one to watch. The "Current" release arrives with a STORE loader interface for private keys, a full NSS 3.125 root certificate update, and a battery of crypto hardening patches that finally shut down FIPS compliance bypasses.
Antoine du Hamel signed off as release steward for the cycle, and the commit log makes it clear the 26.x line is already taking shape ahead of its October LTS promotion. Node.js 24.x remains your safety net until 2028, but the architecture you'll actually be using in two years is being forged right now.
Crypto overhaul takes center stage
Filip Skokan led the cryptographic surface area this cycle. The standout change is OpenSSL's STORE loader, which lets applications pull private keys straight from HSMs or cloud KMS backends without ever writing them to disk. You can register custom key providers at runtime, which removes the whole PEM file dance for enterprises that already run secure storage.
Skokan's team also patched Argon2 from incorrectly skipping FIPS 140 checks, surfaced Diffie-Hellman key exchange failures that were previously swallowed, and added proper mutex initialization for concurrent key operations. If you're shipping anything that handles credentials, tokens, or session state, the silent failure modes are gone.
New APIs and a cleaner test runner
The ModuleHooks API now implements Symbol.dispose, which locks in TC39's Explicit Resource Management proposal for ES modules. Declare a dispose() method, and Node will tear the module down automatically when it unloads. Projects that juggle open file descriptors or long-lived connections finally get standardized cleanup without manual teardown code.
The built-in test runner gains --test-coverage-include-all, so your coverage reports will show dead code instead of just the paths your tests happened to trip over. Keep in mind that inspector tracing is now mutually exclusive with Perfetto. Configure Node with --with-perfetto at build time to get protobuf-encoded trace files viewable at ui.perfetto.dev, but you'll lose inspector tracing until you rebuild.
Electron has already backported the Perfetto implementation, so desktop app developers won't have to wait long.
If you've been tracking the 26.x commits, you've probably noticed Skokan pushing a lot of backend hardening this cycle. That same energy went into the rest of the stack. Matteo Collina and the streams team cut per-chunk allocations in the pipeTo path, which should noticeably reduce GC pressure in high-throughput pipelines. HTTP/2 got a couple of performance tweaks that were quickly reverted after causing regressions, so hold off on chasing those down in production.
The QUIC layer finally gets a fix for the fragmented client hello segfault, and SQLite's Exec() and ApplyChangeset() methods no longer trigger use-after-free bugs. You can also try the experimental node:net/promises subpath if you'd rather work with async functions instead of streams for TCP and IPC.
Dependency updates landed across the board. npm jumped to 11.19.0, V8 bumped to 14.6.202.34-node.26, ada reached 4.0.0, and Rust 1.86 is now the minimum compiler for building from source. Update your toolchain before you run configure.
It's a dense release for a mid-cycle patch, though the crypto fixes are clearly the headline. The Perfetto integration and explicit resource management show where Node is headed, but the reverted HTTP/2 optimizations and the inspector mutual exclusivity are reminders that the 26.x line is still being hammered into shape. If you need production stability, stick with 24.x until October. Pull 26.7.0 if you want to run your suites through the new coverage flag.
Download it from nodejs.org, or grab it via your preferred package manager.
