Node 26 enters LTS as five undici advisories land

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent nodejs/undici

The Agent dropped tls options, which disabled certificate validation for anyone passing them through. Treat every undici release before the patch as trusting whatever certificate it was handed.

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects nodejs/undici

Cross-origin redirects could poison the cache and hand one user's response to another. If you run a shared or proxy cache in front of undici, that is cross-user disclosure, not a nuisance bug.

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake nodejs/undici

A failed HTTP/2 handshake was enough to take the WebSocket client down. 26.12.0 and 24.22.0 shipped the fixes, and the remaining advisories, including unbounded EventSource parser memory and the Subresource Integrity bypass, complete the batch.

2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau nodejs/node

by richardlau

The 26.x line moves to LTS with support through the end of April 2029, so the semver-minor work landed in 26.11.0 and 26.12.0 (buffer isLatin1, crypto.parsePKCS12 in the 24.x line) is now on a supported track.

2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS nodejs/node

by RafaelGSS

V8 15.6 arrives with Math.sumPrecise(), Iterator.prototype.join(), includes and zip enabled by default. The branch also carries the OpenSSL 1.x removal and the node-gyp, Amaro and WebAssembly compile-cache work, so pin your CI off alpha before pulling it.

child_process: build the default env block in one native pass nodejs/node

by codebytere

spawn() and spawnSync() build the child environment block in one native pass instead of walking the process.env proxy per variable. The saving is 20 to 24 percent when options.env is omitted, which is the default path for most build and test spawns.

2.3.0 nodejs/cjs-module-lexer

by guybedford

cjs-module-lexer 2.3.0 initializes Wasm automatically before parsing and speeds up UTF-16 source copies and identifier runs. It also drops Node.js 18, so any toolchain still resolving that line needs a newer runner.

v13.1.0 nodejs/node-gyp

by nodejs-github-bot

node-gyp 13.1.0 updates gyp-next to v0.22.3 and fixes --msvs_version, alongside citgm's red builds traced to loglevel precedence. Native addon builds on Windows were the ones tripping on it.