Node.js just shipped v26.8.2 and v24.21.0 “Krypton” within 24 hours, both carrying the OpenSSL 3.5.8 upgrade and routine dependency bumps. The LTS release stands out with a new STORE loader for hardware security modules, an NSS root certificate update, and notable speedups for URL parsing and HTTP responses. Meanwhile, the current v26 line focuses on internal cleanup, deprecating Server.prototype._listen2, updating Undici to 8.10.2, and improving riscv64 build flags. If you run production workloads, upgrading to v24.21.0 is the smart move before the Maintenance LTS window closes in April 2028, while developers can grab v26.8.2 for the latest Undici behavior and build fixes.

Node.js Ships v26.8.2 and v24.21.0 “Krypton” with OpenSSL 3.5.8

Routine maintenance patches land within 24 hours, but the LTS line gets serious crypto and performance upgrades.

Node.js wrapped up its biweekly release cycle with two updates: v26.8.2 for the current line and v24.21.0 “Krypton” for LTS. Both ship OpenSSL 3.5.8 and routine dependency bumps, but if you run production workloads, v24.21.0 is the one you’ll actually care about.

The releases arrived roughly 24 hours apart, exactly as expected on Node.js’s six-week cadence. v24 “Krypton” entered its Maintenance LTS window back in October 2026, meaning only security patches and critical bug fixes make it through the gate now. v26, which first shipped in May, is still on its Current track before flipping to Active LTS next month. Starting with v27, Node.js will drop the odd/even distinction entirely and move straight to an annual LTS cycle.

v24.21.0 “Krypton” Takes the Lead

The big story here is crypto. Filip Skokan’s PR adds a STORE loader for private keys, which means hardware security modules, PKCS#11 providers, and cloud key management services can finally feed keys directly into Node’s crypto stack. That’s a meaningful win for enterprises that treat key rotation like a compliance checkpoint rather than an afterthought. The release also updates NSS to version 3.126 for root certificate validation, tightens FIPS mode reporting when --enable-fips blows up at startup, and fixes a handful of edge cases that previously crashed the DNS resolver or left use-after-free holes in HTTP/2.

Performance-wise, James Snell and Matteo Collina knocked several bottlenecks loose. URL parsing and URLSearchParams got a notable speedup, net.BlockList lookups run faster, and HTTP responses with a known content length move through the pipeline without the usual overhead. Collina also gutted stream promise churn in hot paths, and the module system now caches the nearest parent package.json per directory. If you run heavy I/O or parse a lot of URLs, those tweaks add up.

It’s worth noting that v24.21.0 landed while still in Maintenance LTS, which usually means someone filed a security ticket that needed an earlier-than-usual patch. Keep in mind that the NSS update and the STORE loader likely carried the weight here, since OpenSSL 3.5.8 alone isn’t enough to force an out-of-cycle release. though the dependency bumps are small, the cumulative effect on enterprise crypto tooling is substantial.

Node.js — Node.js 24.21.0 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 24.21.0 (LTS)

v26.8.2 Keeps the Current Line Tight

The current line gets less fanfare but still covers the essentials. Antoine du Hamel deprecates Server.prototype._listen2, which quietly removes an internal-only API that shouldn’t have been hanging around. Undici bumps to 8.10.2, npm lands at 11.19.1, and corepack reaches 0.36.0. James Snell also tightened the security posture for experimental APIs, so CVE coverage for unstable Node.js features is no longer a gray area.

Under the hood, the build pipeline gets a few quality-of-life improvements. riscv64 builds finally skip the dockit nonsense and use the correct default flags. Windows LTO builds drop a parallelization cap that used to throttle compilation speed, and the GN build system pulls NODE_ARCH directly from target_cpu instead of hardcoding values. Dependabot continues its weekly march through GitHub Actions, with CodeQL, actions/checkout, and setup-node all refreshed to their latest versions.

It’s a rather clean release for what it is. The internal cleanup and dependency bumps don’t make for headline news, but they keep the bleeding edge stable without introducing the kind of churn that breaks CI pipelines on a Tuesday afternoon. Not bad.

Node.js — Node.js 26.8.2 (Current)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 26.8.2 (Current)

If you’re running v24 in production, grab 24.21.0. You are already in its Maintenance LTS window, so this patch covers the final security rounds before April 2028. For development work or projects that need riscv64 support or the latest Undici behavior, v26.8.2 is ready to install.