Node 26.11.0 lands buffer.isLatin1 and stringLength

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

The same release removes RSA-OAEP, KEM, and verify-setup key locking, and Node now loads most ES modules synchronously.

187 commits 88 PRs merged 3 releases 7 briefings covered

all nodejs reviews →

← previous week nodejs wire → next week →

2026-10-07, Version 26.11.0 (Current), @aduh95 nodejs/node

by aduh95

26.11.0 adds buffer.isLatin1 and stringLength as semver-minor additions, alongside removal of the RSA-OAEP, KEM, and verify-setup key locks. Crypto operations that previously serialized on those locks, ML-KEM among them, now run without the mutex.

crypto: remove RSA-OAEP key locking nodejs/node

by Filip Skokan

RSA_Cipher delegates to ncrypto::Rsa with a fresh EVP_PKEY_CTX per operation, so padding, digests, labels, and output buffers belong to the call rather than a shared key. The commit message says the lock was introduced for early OpenSSL and BoringSSL synchronize RSA blinding and Montgomery caches internally.

crypto: remove KEM key locking nodejs/node

by Filip Skokan

ncrypto::KEM likewise allocates a context per operation, and ML-KEM expansion finishes during import, so operations read an immutable key. EC and X25519 retain read-only recipient keys, which is what makes dropping the lock safe here.

module: synchronously load most ES modules nodejs/node

by GeoffreyBooth

Building on the require(esm) path, Node now synchronously resolves and loads ES modules that lack top-level await. The sync path applies when no async loader hooks, --import flags, or --inspect-brk are active.

src: migrate from deprecated xxxV2 APIs nodejs/node

by Michaël Zasso

The C++ side swaps the deprecated Set/GetPrototype Holder V2 APIs for their current replacements. This is groundwork against the eventual removal of those V8 entry points, with Joyee Cheung and Michaël Zasso credited.

build: use ICU_UTIL_DATA_STATIC across V8 nodejs/node

by Joyee Cheung

Node defined ICU_UTIL_DATA_SHARED long after upstream removed it, so mksnapshot ICU initialization on Windows had been failing silently. The build now uses ICU_UTIL_DATA_STATIC across V8.

Revert "deps,lib,tools: remove jitless and lite modes" nodejs/node

by Joyee Cheung

V8 no longer supports --allow-overwriting-for-next-flag, so jitless and lite modes return as an opt-in rather than a preset override. The revert restores the flags for users who need them.

2.3.0 nodejs/cjs-module-lexer

by guybedford

2.3.0 initializes Wasm automatically before parsing and speeds UTF-16 source copies by skipping identifier and number runs. It also drops Node.js 18 support, so anyone still building on that line is outside the supported matrix.

$ ls nodejs/week/ # the briefings behind this review

Mon Oct 5 Node.js migrates off deprecated V8 APIs and fixes a long-silent Windows ICU path Tue Oct 6 V8 drops the flag override, so jitless and lite modes come back Wed Oct 7 Node loads most ES modules synchronously Thu Oct 8 Node 26.11.0 lands Latin1 checks and stringLength as crypto locks come out Fri Oct 9 Undici caps cached and error-body retention, drops Milo from the Node core bundle Sat Oct 10 cjs-module-lexer drops Node.js 18, doc-kit opens its Markdown pipeline Sun Oct 11 Faster http2 getHeaders, WASM errors on jitless builds

all nodejs reviews →

← previous week nodejs wire → next week →