Node.js 24.22.0 LTS and 26.12.0 Current: What Shipped

The key facts #

The release pages are Node.js 24.22.0 (LTS) and Node.js 26.12.0 (Current). The GitHub release notes for v24.22.0 and v26.12.0 list the same notable changes. The fetched 24.22.0 pages were truncated, so this summary covers only the entries visible in the source excerpts.

• 24.22.0 adds crypto.parsePKCS12(), a generic MAC API, and SIV and GCM-SIV modes in the Cipher and Decipher APIs.
• 24.22.0 discovers ciphers and hashes from OpenSSL providers.
• 24.22.0 adds close() and Symbol.dispose methods to StatementSync in node:sqlite.
• 24.22.0 adds util.throttle, util.debounce, and util.markPromiseAsHandled.
• 24.22.0 adds histogram features in perf_hooks, including SlidingWindowHistogram, a Histogram meanCI API, qrde analysis support, and CBOR export and import.
• 24.22.0 allows net.BoundSocket to be sent to threads and child processes.
• 26.12.0 makes the runtime throw when WebAssembly or RX support is missing.
• 26.12.0 adds websocketMask() and websocketUnmask() to http.

Many 24.22.0 entries are fixes and internal changes rather than new APIs. The crypto section includes a correction to the CCM decryption FIPS error message and a limit check on PBKDF2 iterations. The 26.12.0 notable list contains no new crypto or SQLite APIs. Its stream and benchmark work appears in the commit list instead.

Why it matters #

For the LTS line, crypto is the largest group of notable changes. A generic MAC API and algorithm discovery from OpenSSL providers suggest that application code can query what the runtime exposes instead of relying on a fixed set. This is our inference from the entry titles, not something the changelog describes. The titles contain no benchmark numbers, so performance claims need measurement against your own workload.

The Current throw change alters runtime behavior, so it deserves attention. The source gives only the commit title, which says the runtime now throws on missing WebAssembly or RX support. The sources do not expand the RX abbreviation or say which builds lack those features. Our inference is that builds without them may now fail earlier and more visibly. Test this in your pipeline before moving a Current build into a longer-lived environment.

Who is affected #

Teams running Node.js in FIPS-constrained environments should review the crypto entries first. These include a strict mode added to --force-fips and a change that disables non-FIPS WebCrypto paths in FIPS mode. Applications that use node:sqlite gain explicit cleanup through close() and Symbol.dispose.

Stream-heavy services should review the 26.12.0 stream/iter commits, including dump() and dumpSync() and a failOnIncompleteClose option for pipeToSync(). Permission-model users should check the change that keeps explicit filesystem grants when a covering directory is dropped, and the addition of --allow-fs-vfs to the permission flags. Build maintainers should note Python 3.15 support in 26.12.0 and the GN build changes in 24.22.0. Both releases also update dependencies such as V8, simdjson, zlib, googletest and npm. The notes do not include test or benchmark results, so verify each release against your own workload before a wide rollout.