Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core

The headline is the shift toward stricter, more explicit core APIs. Node 26.6.0 and 26.7.0 brought a wave of changes, but the through-line is a deliberate tightening: HTTP now runtime-deprecates constructing without `new` [1], and `Server.prototype._listen2` follows the same path [2]. These mark the start of a transition, not an immediate break, so existing code keeps running but should start migrating before the next major. In the same spirit, streams now honor `AbortSignal` in `Writer.end()` [3], giving callers a way to cancel a pending write instead of leaving it dangling.

Performance landed across streams and the event loop. WHATWG tee and BYOB reads got a reduction in per-chunk work [4], and the commit queue received an efficiency fix after a patch . The FFI layer also hardened: fast calls are now rejected after a library close [5], which prevents a use-after-close crash, and a memory leak fix landed earlier in the month. The fixes came after the FFI crash was caught before it spread widely.

Crypto went through a notable period. Private keys can now be loaded through STORE loaders [6], which broadens the supported key loading paths. The TLS layer made an abort into a throw , turning an asynchronous, possibly silent failure into a synchronous, visible one. Root certificates updated to NSS 3.125 [7], and the crypto stack put BoringSSL front and center, which is a signal of the direction for future crypto work.

The dependency and tooling sync across the Node ecosystem was a constant thread. zlib landed ZIP archive support with ZipFile, ZipBuffer, and ZipEntry, plus a move to zlib 1.3.2.1-motley [8][9]. Undici shipped 8.10.0 fixing an interceptor failure where cache() and deduplicate() were silently inert without opts.origin [10] as well as allowing interceptors without that option [11]. Node core deps synced across the stack as part of that release . The Docker toolchain also tightened, with a jq requirement added and a fix to release key sync , and the compile cache turned read-only as part of a hardening effort.

The direction is clear: Node is spending August reducing silent failure modes and making performance tradeoffs explicit. The runtime deprecations in HTTP and net, the TLS abort becoming a throw, and the zlib/stream API additions all fit that pattern. If you maintain a library that constructs HTTP servers or calls `_listen2`, start planning for the deprecations now, because they will not get quieter.