Stay updated with the latest Node.js releases, security patches, and feature updates.
Generate the latest config in seconds with ConfigDeck.
The Node.js project has a beta preview of redesigned API docs at beta.docs.nodejs.org, built on a new standalone tool called doc-kit, and is actively requesting community feedback before making it the default.
Node.js has pre-announced security releases for the 26.x, 24.x, and 22.x lines scheduled for July 27, 2026, with the highest severity rated HIGH across all three.
Node.js 26.5.0 ships five SEMVER-MINOR additions including blob.textStream(), an --experimental-import-text flag, event loop delay sampling in perf_hooks, exposed ReadableStreamTee, and TLS group negotiation reporting. Addon import support is now enabled by default.
Node.js 26.4.0 ships package maps, a new virtual filesystem subsystem, caller-supplied readFile buffers, TLS certificate compression, and expanded TCP keepalive options — all as semver-minor additions.
Node.js 24.18.0 'Krypton' LTS lands with a larger default Buffer pool, new Web Cryptography algorithms, HTTP 1xx support, and a substantial batch of crypto hardening work.
Node.js 26.3.1 is a security release addressing 11 CVEs across TLS, HTTP/2, crypto, DNS, and the permission model. Two are rated High severity, targeting hostname verification and WebCrypto cipher output.
Node.js 26.3.0 ships a larger default Buffer pool, a new permission.drop API, configurable HTTP header validation, updated root certificates, and a heads-up about the future of macOS universal binaries.
The first LTS point release for Node.js 24 'Krypton' lands with UUIDv7 generation, abortable fs.stat(), test order randomization, and a hardened HTTP client request options merge.
Node.js 22.22.3 'Jod' is a maintenance LTS release with OpenSSL 3.5.6, updated root certificates, a batch of V8 backports, and several fixes for use-after-free and null-pointer bugs across crypto, zlib, and http2.