On this page · 4 sections
  1. What Can Break: _listen2, Hmac and RX Memory
  2. Dependencies on the LTS Line
  3. Security Releases That Followed
  4. Sources

TL;DR

Node.js 24.22.0, the LTS release of October 14, brings a batch of APIs from the 26 line to LTS: crypto.parsePKCS12(), a generic MAC API, StatementSync.prototype.close() for node:sqlite, util.throttle and util.debounce. It also deprecates Server.prototype._listen2 and fixes Hmac.digest() returning uninitialized memory. Node.js 26.12.0, released the same day, now throws when WebAssembly or read-execute (RX) memory support is missing.

  • Crypto in 24.22.0: crypto.parsePKCS12() (#65627), a generic MAC API (#65553), ciphers and hashes discovered from OpenSSL providers (#65484), and SIV and GCM-SIV modes in the Cipher and Decipher APIs (#63411).
  • SQLite in 24.22.0: StatementSync.prototype.close() and [Symbol.dispose]() (#64232), so a statement can be closed explicitly or with using.
  • Utilities in 24.22.0: util.throttle, util.debounce (#65899) and util.markPromiseAsHandled (#65805); net.BoundSocket can be sent to threads and child processes (#64725).
  • Diagnostics in 24.22.0: SlidingWindowHistogram, qrde analysis and a meanCI API for histograms, and CBOR export and import for histogram exchange.
  • 26.12.0: Node.js throws on missing WebAssembly or RX support (#66533), and http gains websocketMask() and websocketUnmask() (#66335).

What Can Break: _listen2, Hmac and RX Memory #

Three changes can affect existing code. 24.22.0 deprecates Server.prototype._listen2 in node:net (#65593); it is a documentation deprecation, so code that calls it keeps working for now. Among its commits, 24.22.0 also fixes Hmac.digest() returning uninitialized memory (#65112), a reason on its own to take the release on the LTS line.

In 26.12.0, Node.js now throws when WebAssembly or RX support is missing (#66533). RX memory is memory mapped as both readable and executable; systems or builds without it, or without WebAssembly, now get an explicit error.

Dependencies on the LTS Line #

24.22.0 upgrades npm to 11.19.1 (#65573) and updates zlib, simdjson 4.6.11 and googletest. 26.12.0 updates simdjson to 5.0.3, SQLite to 3.54.0, acorn and googletest and cherry-picks two V8 fixes; it does not change npm or zlib. On the Current line, 26.12.0 also propagates config-file permission flags to child processes (#66559) and keeps the root certificate store per Environment (#66411).

Security Releases That Followed #

Neither release is the one to install today. On October 21, the October security releases 24.22.1 and 26.12.1 fixed ten CVEs, and on November 11 a further round, 24.22.3 and 26.13.1, fixed sixteen more. Teams adopting the 24.22.0 features should go straight to the newest 24.22 release, and 26.x users to the newest 26.13 release, since 26.13.0 made the 26 line LTS.

The Sentinel’s Call

Teams on Node.js 24 LTS gain parsePKCS12, the MAC API and explicit SQLite statement closing with 24.22.0, plus a fix for Hmac.digest() returning uninitialized memory, but should install the latest 24.22 security release rather than 24.22.0 itself. Libraries that still call Server.prototype._listen2 should move off it. On the 26 line, systems without RX memory now fail with an explicit error.

Our judgement, drawn only from the facts and sources above.

Verified We installed Node.js 24.22.0 from the official Docker images and ran it on Nov 13, 2026.

  • Node.js 24.22.0 node --version

    v24.22.0

    Full output and environment
    node:24.22.0-slimsha256:91acba91b842…
    $ node --version
v24.22.0

Isolated container: official image, network off, read-only, no host files. How we check

Sources

  1. Release 2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95 · nodejs/node · GitHub github.com · Oct 14, 2026
  2. Release 2026-10-14, Version 26.12.0 (Current), @richardlau · nodejs/node · GitHub github.com · Oct 14, 2026

More on Node.js

5 other articles, newest first

Next reading

Edited and approved by Jarosław Krzemiński. Spotted a mistake? Report a correction or read the corrections policy.