What shipped in Node.js on August 25, 2026?

Node.js turns a hard crash into a recoverable error, and changelog-maker ships a breaking rework. In total, 20 commits, 18 pull requests, and 3 releases landed.

Who contributed to Node.js on August 25, 2026?

10 developers shipped this update, including Aviv Keller, nodejs-github-bot, RafaelGSS, mcollina, sankalpsthakur, Jacob Smith, github-actions[bot], and semantic-release-bot, and 2 more.

What were the notable Node.js updates?

tls: throw on invalid ALPNProtocols instead of aborting, permission: guard UDP handle adoption, and crypto: update root certificates to NSS 3.126.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

Node's TLS abort becomes a throw

By RepoJournal · Filed 06:56 UTC on August 25, 2026 · About Node.js

10 people shipped this

Aviv Keller @avivkeller 1 cited

nodejs-github-bot @nodejs-github-bot 1 cited

RafaelGSS @RafaelGSS 1 cited

mcollina @mcollina 1 cited

sankalpsthakur @sankalpsthakur 1 cited

Jacob Smith @JakobJingleheimer 1 cited

github-actions[bot] @github-actions[bot] 1 cited

semantic-release-bot @semantic-release-bot

Antoine du Hamel @aduh95

dependabot @dependabot

Node.js turns a hard crash into a recoverable error, and changelog-maker ships a breaking rework.

Node.js fixed a crash-on-invalid-input in TLS: tls.connect() with malformed ALPNProtocols no longer aborts the process with SIGABRT, instead throwing a recoverable TypeError [1]. Meanwhile, the permission model tightened UDP handle adoption under IPC [2], and root certificates refreshed to NSS 3.126, dropping two CAs and adding four [3]. Over in streams, Matteo Collina's optimizations for WHATWG WebStreams cut encoding and iteration overhead [4]. And changelog-maker released 5.0.0, breaking its CLI flags: "--sha, --plaintext, -p, --markdown, --md, --messageonly and --mo are no longer supported, use --format instead" [5]. Doc-kit cleaned up peer deps in changesets [6], and next-10 documents vlt and Node version manager options [7].

Action items

→ Update to Node.js with PR #65076 to avoid SIGABRT on invalid ALPNProtocols nodejs/node [immediate]
→ Migrate changelog-maker scripts to --format before upgrading to 5.0.0 nodejs/changelog-maker [immediate]
→ Review the new root certificates after your next Node.js update nodejs/node [monitor]

References

[1] tls: throw on invalid ALPNProtocols instead of aborting ↗ nodejs/node
[2] permission: guard UDP handle adoption ↗ nodejs/node
[3] crypto: update root certificates to NSS 3.126 nodejs/node
[4] stream: reduce webstreams encoding and iteration overhead ↗ nodejs/node
[5] v5.0.0 ↗ nodejs/changelog-maker
[6] fix(changesets): remove peer deps (#1050) nodejs/doc-kit
[7] doc: add `vlt` to package manager list & enumerate node version manager opts (#396) nodejs/next-10

Quick answers

What shipped in Node.js on August 25, 2026?: Node.js turns a hard crash into a recoverable error, and changelog-maker ships a breaking rework. In total, 20 commits, 18 pull requests, and 3 releases landed.
Who contributed to Node.js on August 25, 2026?: 10 developers shipped this update, including Aviv Keller, nodejs-github-bot, RafaelGSS, mcollina, sankalpsthakur, Jacob Smith, github-actions[bot], and semantic-release-bot, and 2 more.
What were the notable Node.js updates?: tls: throw on invalid ALPNProtocols instead of aborting, permission: guard UDP handle adoption, and crypto: update root certificates to NSS 3.126.