Node.js 24.22.0 is an LTS release in the Krypton line. Richard Lau published the announcement on 14 October 2026, and @aduh95 prepared the release.

The crypto module adds `crypto.parsePKCS12()`, a generic MAC API and provider-based discovery for ciphers and hashes. `Cipher` and `Decipher` now support SIV and GCM-SIV modes. Web Cryptography gains Hybrid KEMs. The release also adds FIPS diagnostics, a strict mode for `--force-fips`, provider-backed key handling, `mgf1Hash` for RSA-OAEP, and validation for PBKDF2 and HKDF inputs. Several RSA, EC, PKCS#8, SPKI, X.509 and HMAC issues are fixed.

The net module can transfer `net.BoundSocket` objects to threads and child processes. `perf_hooks` adds `SlidingWindowHistogram`, qrde analysis support, the `meanCI` API, and CBOR exchange for histograms. SQLite adds `StatementSync.prototype.close()` and `StatementSync.prototype[Symbol.dispose]()`. It also gains a diagnostic channel and stricter callback and URL-path handling. The util module adds `util.markPromiseAsHandled`, `util.throttle`, and `debounce`. `Server.prototype._listen2` is deprecated.

Runtime fixes cover assertions with null Map keys or Set members, unaligned UTF-16LE decoding, spawn-time timeout cleanup, and `AbortSignal.any()` propagation. Filesystem changes address recursive watch races, symlink handling in glob patterns, read-only deletion on Windows, copy metadata, and non-ASCII error messages. HTTP and HTTP/2 receive teardown, backpressure, and deadlock fixes. QUIC receives HTTP/3 stream corrections and a crash fix. Stream, inspector, startup, and memory-lifecycle paths also receive fixes.

Build changes enable the V8 sandbox in shared-cage builds, improve GN dependency linking, correct riscv64 defaults, and suppress OpenSSL assembly warnings with clang. The release includes V8 backports, npm 11.19.1, simdjson 4.6.11, and zlib 1.3.2.1-motley-285e94b. Documentation and tests receive updates for OpenSSL 4.1, FIPS mode, permissions, SQLite, QUIC, zstd, and `DEP0185` behavior.