Node.js 24.20.0 'Krypton' (LTS) was released on 2026-08-26, prepared by Antoine du Hamel. The release bundles nine semver-minor features along with a long list of fixes and dependency updates.
The headline changes: async_hooks gains using scopes for AsyncLocalStorage (Stephen Belanger, #61674). The buffer API gets an end parameter (Robert Nagy, #62390). The permission model adds permission.drop (Rafael Gonzaga, #62672) and a new --permission-audit flag (RafaelGSS, #61869). The module loader implements package maps (Maël Nison, #62239). Streams get a node:stream/iter implementation (James M Snell, #62066). The test runner adds context.log() and a test:log event, and reports entryFile in TestStream events (Moshe Atlow, #64389, #64309). WebAssembly enables JSPI (Guy Bedford, #59941).
Crypto work dominates the fix list. Root certificates were updated to NSS 3.125. Filip Skokan contributed a series of hardening commits: preserving OpenSSL errors from KDF failures, fixing Argon2 bypassing FIPS mode, handling incomplete RSA private keys, cleansing provider private key copies, and splitting the OpenSSL 3, BoringSSL and legacy backends. KangarooTwelveParams customization is now limited to 512 bytes.
The QUIC implementation received extensive attention, with dozens of commits from James M Snell, Tim Perry and others covering session rate limiting, TLS certificate compression, a segfault fix after fragmented client hellos, and a listEndpoints API. SQLite fixes address use-after-free in Exec() and ApplyChangeset() and a crash when a session outlives its database.
Networking gains include TCP server and socket transfer across worker threads and TCP handle transfer on Windows (Matteo Collina). HTTP fixes cover writableFinished after write errors. Dependency updates include npm 11.19.0, ada 4.0.0, sqlite 3.53.4, ngtcp2 1.25.0, nghttp3 1.18.0, nghttp2 1.70.0, acorn 8.18.0, c-ares 1.34.8, minimatch 10.2.6, simdjson 4.6.6 and timezone data 2026c. Mike McCready (MikeMcC399) was added as a collaborator.
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.