$ the-wire · showcase
Node 26.11.0 lands Latin1 checks and stringLength as crypto locks come out
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
Node.js 26.11.0 ships two new buffer APIs, and a four-commit crypto series removes the outer key locks that serialized operations sharing a KeyObject or CryptoKey.
2026-10-07, Version 26.11.0 (Current), @aduh95 nodejs/node
The 26.11.0 Current release adds `buffer.isLatin1` and `Buffer.stringLength()` as semver-minor additions, both of which land on the promise of cheaper encoding checks and size calculations without a full conversion or allocation.
crypto: remove RSA-OAEP key locking nodejs/node
The RSA-OAEP lock is gone: RSA_Cipher delegates to ncrypto::Rsa with a new EVP_PKEY_CTX per operation, so padding, digests, labels, and output buffers belong to that context rather than to shared key state. The lock only existed for early OpenSSL 3 key downgrading that cleared shared provider fields, and current OpenSSL publishes a separate legacy cache under its own lock.
crypto: remove KEM key locking nodejs/node
KEM operations now build a fresh EVP_PKEY_CTX per call, with parameters, entropy, scratch buffers, and outputs private to each invocation, and ML-KEM expansion finishes during import so operations read an immutable key. The outer locks serializing jobs that share a KeyObject or CryptoKey are removed; EC and X25519 keep read-only recipient keys and RSA synchronizes its own caches.
crypto: remove verify setup key locking nodejs/node
Verify setup only copies signature bytes and reads the DSA/EC order width for P1363 conversion, which constructs independent DER and BIGNUM values, so the mutex around it is unnecessary. Signing and verification already ran without it using separate operation contexts.
crypto: remove key export and metadata locks nodejs/node
Raw and JWK getters now return independently owned bytes or BIGNUMs, RSA metadata snapshots public parameters and PSS restrictions, and EC fallback paths reconstruct or duplicate the source key, so the export and metadata locks could be dropped. Older OpenSSL 3 key downgrading mutated shared provider fields; current OpenSSL keeps separate legacy and provider conversion caches under internal rea...
feat: Node.js 26.11.0 nodejs/docker-node
docker-node picked up Node.js 26.11.0, and an automated follow-up merged the 26.11.1 image bump, so the official images track the release line within hours of each cut.
