$ the-wire · showcase
Node 26 becomes LTS Lithium, alongside TLS session-reuse and http2 timeout fixes
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
Node 26.13.0 turns the 26.x line into LTS through April 2029, while three separate fixes land in node for TLS session reuse behind literal-IP sockets, cross-isolate X.509 chains, and an http2 idle timer that retained destroyed sessions.
2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau nodejs/node
Node.js 26.13.0 'Lithium' moves 26.x into Long Term Support with updates through the end of April 2029. Beyond metadata such as the process.release object, nothing changed from 26.12.1, so this is a support-window change rather than a code change.
net,tls: fix session reuse with provided sockets nodejs/node
tls.connect() wrapping a net.Socket connected to a literal IP address did not retain the requested host, letting the TLS layer fall back to localhost and reject the offered session on an identity mismatch. The regression surfaced after the host-binding hardening in CVE-2026-48934; the fix preserves the requested host for literal-IP sockets.
crypto,tls: clone X.509 chains across isolates nodejs/node
X509Certificate cloning dropped issuerCertificate and shared one native X509 object across isolates. The leaf and supplied peer chain are now snapshotted as DER and reparsed per isolate, with each supplied position getting its own object, including repeated certificate encodings, for TLS inspection, structuredClone(), MessagePort, and workers.
http2: clear the session timeout before marking it destroyed nodejs/node
closeSession() set SESSION_FLAGS_DESTROYED before calling session.setTimeout(0), and setStreamTimeout() returns early once a session is destroyed, so the idle timer stayed armed and retained the session until the server timeout fired. The timeout and its listeners are now cleared before the destroyed flag goes up.
feat(release): support alpha releases nodejs/node-core-utils
git node release learns the alpha release lines Node.js 27 introduces: --prepare detects them from the NODE_ALPHA_*_VERSION macros in src/node_version.h, computes the next vN.0.0-alpha.X.Y.Z from commit semver labels, and creates CHANGELOG_V{N}.md when it does not exist yet. Elsewhere, Node.js v24.22.2 reached the official images, and doc-kit's legacy-html renderer now leaves $ sequences in tem...
