Dev · Releases
Node.js 24.22.0 LTS widens crypto and runtime support
Node.js 24.22.0, the LTS release named Krypton, arrived on 14 October 2026.
It adds PKCS#12 parsing, a generic MAC API and OpenSSL provider discovery in crypto. The release also expands perf_hooks and sqlite APIs, supports BoundSocket transfer to threads and child processes, and updates npm to 11.19.1. It includes broad runtime, build and documentation fixes.
Node.js 24.22.0 is an LTS release in the Krypton line. Richard Lau published the announcement on 14 October 2026, and @aduh95 prepared the release.
The crypto module adds `crypto.parsePKCS12()`, a generic MAC API and provider-based discovery for ciphers and hashes. `Cipher` and `Decipher` now support SIV and GCM-SIV modes. Web Cryptography gains Hybrid KEMs. The release also adds FIPS diagnostics, a strict mode for `--force-fips`, provider-backed key handling, `mgf1Hash` for RSA-OAEP, and validation for PBKDF2 and HKDF inputs. Several RSA, EC, PKCS#8, SPKI, X.509 and HMAC issues are fixed.
The net module can transfer `net.BoundSocket` objects to threads and child processes. `perf_hooks` adds `SlidingWindowHistogram`, qrde analysis support, the `meanCI` API, and CBOR exchange for histograms. SQLite adds `StatementSync.prototype.close()` and `StatementSync.prototype[Symbol.dispose]()`. It also gains a diagnostic channel and stricter callback and URL-path handling. The util module adds `util.markPromiseAsHandled`, `util.throttle`, and `debounce`. `Server.prototype._listen2` is deprecated.
Runtime fixes cover assertions with null Map keys or Set members, unaligned UTF-16LE decoding, spawn-time timeout cleanup, and `AbortSignal.any()` propagation. Filesystem changes address recursive watch races, symlink handling in glob patterns, read-only deletion on Windows, copy metadata, and non-ASCII error messages. HTTP and HTTP/2 receive teardown, backpressure, and deadlock fixes. QUIC receives HTTP/3 stream corrections and a crash fix. Stream, inspector, startup, and memory-lifecycle paths also receive fixes.
Build changes enable the V8 sandbox in shared-cage builds, improve GN dependency linking, correct riscv64 defaults, and suppress OpenSSL assembly warnings with clang. The release includes V8 backports, npm 11.19.1, simdjson 4.6.11, and zlib 1.3.2.1-motley-285e94b. Documentation and tests receive updates for OpenSSL 4.1, FIPS mode, permissions, SQLite, QUIC, zstd, and `DEP0185` behavior.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.