Node.js Ships Coordinated Updates for Current and LTS Lines, With an Unusual Day-One Patch
The new releases bring native zip support, RAII-style SQLite, and permission auditing to production.
Node.js 26.8.0 and Node.js 24.20.0 "Krypton" landed in the wild today. The Current line and the LTS track both received coordinated updates, but the Current line got an unusual companion. Just hours after shipping 26.8.0, release lead Antoine du Hamel pushed out 26.8.1 as an out-of-band patch.
The reason is purely cosmetic. node --version was reporting an alpha designation for what was supposed to be a stable release. It's a metadata quirk, not a functional bug. Out-of-band releases on the same day as the initial drop are rare, and usually signal something far more serious than a build script reporting the wrong version string.
What's New in Node.js 26.8.x
The Current line gets a solid set of changes, led by crypto hardening. Filip Skokan added SIV and GCM-SIV cipher modes to the Cipher and Decipher APIs. This gives you AEAD nonce-misuse resistance. If you are handling sensitive data, the improved FIPS mode and more accurate SubtleCrypto.supports() reporting are worth noting. Root certificates are updated to NSS 3.126.
SQLite, the built-in module, gets serious attention. Guilherme Araújo added StatementSync.prototype.close() and [Symbol.dispose](). You can now use the using keyword for RAII-style resource management. The module also rejects statement-less SQL and validates integer bindings. It's pushing the bundled SQLite closer to a "safe by default" posture.
Philipp Dunkel added a native zip API to zlib. ZipEntry, ZipFile, and ZipBuffer classes handle creation, reading, and writing. For years, you've had to pull in third-party packages like adm-zip or archiver. This removes a common dependency. Not cheap in terms of development time, but a quality-of-life win for anyone building archives or unpacking user uploads.
Aviv Keller finally brought syntax highlighting to the Node.js REPL. It's a small win, but one the community has wanted for a long time. The line also adds a non-throwing MIMEType.parse() variant, improves HTTP performance with known-length end() calls, and supports Power 9 and z14 architectures.
Node.js 24.20.0 "Krypton" LTS
If you are on LTS, Node.js 24.20.0 brings a different set of upgrades. The biggest addition is AsyncLocalStorage using scopes. Stephen Belanger implemented this to align with TC39's UsingExpression proposal. It lets you structure resource management with explicit scopes.
const storage = new AsyncLocalStorage();
async function withResource(fn) {
const resource = createResource();
return await storage.run(resource, fn);
}
Rafael Gonzaga added permission.drop API and a --permission-audit flag. The former lets you programmatically drop permissions within a scope. The latter audits all permission requests during execution without denying anything. It's useful for diagnosing permission issues in existing codebases without breaking them.
Maël Nison implemented package maps in the loader. This remaps package import specifiers at runtime. It's a foundational feature for module federation and conditional imports without touching node_modules. Framework authors should keep an eye on this one.
James M Snell added node:stream/iter for iterator-based stream APIs. It includes async iterators with better performance. Guy Bedford enabled JavaScript Promise-Based Interface (JSPI) for WebAssembly, allowing async loading via promises. The QUIC implementation gets extensive improvements. Tim Perry added hostname verification, stream idle timeout, certificate compression, and proper error codes. It's maturing significantly. SQLite updates to 3.53.4. npm upgrades to 11.19.0.
A Busy Day for the Project
These releases ship alongside Node.js security advisories. Check the official vulnerability page for specific CVE numbers. They are typically classified as HIGH or CRITICAL depending on exploitability.
Node.js 24.x "Krypton" has been LTS since October 2024. It's now Current LTS. Node.js 26.x remains the Current line. Antoine du Hamel is release lead for both.
It's a busy day for the Node.js project. The Current line gets crypto hardening, native zip, and SQLite RAII. The LTS line gets explicit resource management, permission auditing, and package maps. If you are running production workloads, the LTS update is probably the one you want to prioritize.
Keep in mind that the 26.8.1 patch is purely for the version string metadata. The core functionality in 26.8.0 remains the same.
Node.js — Node.js 26.8.1 (Current)
Node.js
is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js — Node.js 24.20.0 (LTS)
Node.js
