2026-11-12, Version 27.0.0-alpha.0.1.0 (Alpha), @aduh95

Notable Changes

• [33d4e6c73a] - (SEMVER-MINOR) child_process: add subprocess.timedOut (Marco) #66639
• [edc7ec4a77] - (SEMVER-MINOR) crypto: make X.509 inspection guards explicit (Filip Skokan) #67245
• [0882e9729b] - (SEMVER-MINOR) crypto: add X.509 generation with CSR support (Filip Skokan) #67245
• [2360d3860e] - (SEMVER-MINOR) dns: coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599
• [dc4aa75983] - doc: add efekrskl to collaborators (Efe Karasakal) #67376
• [9695304ab8] - doc: add Philipp Dunkel to contributors (Philipp Dunkel) #67378
• [41db1f7b6b] - doc: add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377
• [6b8a90d41d] - (SEMVER-MINOR) http: batch body spans per parser execute (Guilherme Araújo) #67187
• [8ffcb3ee55] - (SEMVER-MINOR) sea: generate a compile cache for the VFS modules (Matteo Collina) #66768
• [2bbcfa0718] - (SEMVER-MINOR) worker: preload streams into startup snapshot (Matteo Collina) #66311

Commits

• [81d2321054] - benchmark: add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837
• [04b4552a77] - Revert "benchmark: add URLSearchParams iterator consumers benchmark" (Antoine du Hamel) #66837
• [3ac0b42fb6] - benchmark: add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837
• [cdef4ac92b] - benchmark: merge crc32c into crc32 zlib benchmark (Trivikram Kamat) #67004
• [faf48bfc07] - buffer: limit UTF-8 fast calls to safe one-byte strings (Robert Nagy) #67136
• [b7aab20d60] - build: separate host and target Rust artifacts in cross builds (Yuya Inoue) #66823
• [829afea634] - build: refresh markdown lint dependencies on lockfile changes (Yuya Inoue) #67185
• [d9292c4a93] - build: sync Torque outputs with V8 (Filip Skokan) #67238
• [9fca7e78bd] - build: use a single producer for shared generated files (Yuya Inoue) #66804
• [5848a08450] - build: sort the ICU source lists (Shelley Vohr) #67206
• [0e1891a0e2] - build: set V8_DISABLE_PRESERVE_MOST (Joyee Cheung) #67093
• [9c57966fb6] - build: error on incompatible dtls configure flags (Antoine du Hamel) #66947
• [0487449970] - build: fix overriding node_path in GN build (David Babenko-Sanders) #66805
• [c617a93aa9] - build: remove unused FIPS export condition (Filip Skokan) #67005
• [823549f0da] - build,win: minify pgo training build (Stefan Stojanovic) #67214
• [2f89ed5fde] - child_process: inherit a reassigned process.env (Caleb Everett) #66883
• [33d4e6c73a] - (SEMVER-MINOR) child_process: add subprocess.timedOut (Marco) #66639
• [42933d1749] - crypto: remove the FIPS provider name check (Filip Skokan) #67358
• [edc7ec4a77] - (SEMVER-MINOR) crypto: make X.509 inspection guards explicit (Filip Skokan) #67245
• [0882e9729b] - (SEMVER-MINOR) crypto: add X.509 generation with CSR support (Filip Skokan) #67245
• [d02681572b] - crypto: fix ncrypto provider behavior (Brad Anderson) #67039
• [0c4d131adf] - crypto: prevent stale OpenSSL errors (Matteo Collina) #67225
• [33d28a1fed] - crypto: reuse HMAC contexts in createHmac() (Yagiz Nizipli) #67109
• [b9248dc829] - crypto: skip clearing empty OpenSSL error queues (Yagiz Nizipli) #67109
• [216f1238cd] - crypto: cache digests for synchronous operations (Yagiz Nizipli) #67109
• [5991efaf17] - crypto: skip DH checks for recognized groups (Filip Skokan) #67071
• [7b8589b5b0] - crypto: add X509Certificate inspection getters (Filip Skokan) #67082
• [ab5da00e5d] - crypto: reject immutable random fill buffers (Filip Skokan) #66944
• [1d297add9e] - crypto: preserve errors during X.509 issuer checks (Filip Skokan) #66898
• [5409ed48c9] - crypto,tls: clone X.509 chains across isolates (Filip Skokan) #66898
• [988d73f171] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [cb3be3e9b5] - deps: update nghttp2 to 1.71.0 (Node.js GitHub Bot) #67331
• [2539d1cb3f] - deps: update ngtcp2 to 1.26.0 (Node.js GitHub Bot) #67257
• [64cdd369d3] - deps: patch V8 to 15.6.75.50 (Node.js GitHub Bot) #67335
• [866be801c1] - deps: update simdjson to 5.1.1 (Node.js GitHub Bot) #67332
• [0c0d945a18] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272
• [4cc7d1bea6] - deps: upgrade npm to 12.2.2 (npm team) #67265
• [0c0d3ee663] - deps: V8: cherry-pick c38986131c02 (Joyee Cheung) #67093
• [efd0b5af1a] - deps: load amaro from dist/internal.js (Geoffrey Booth) #66144
• [51ce159d04] - deps: update amaro to 1.3.0 (Node.js GitHub Bot) #66144
• [38da2b9ad9] - deps: update perfetto to 59.1 (Node.js GitHub Bot) #67171
• [c32c7e8d87] - deps: update simdjson to 5.1.0 (Node.js GitHub Bot) #67172
• [be9989a092] - deps: patch V8 to 15.6.75.33 (Node.js GitHub Bot) #67174
• [2360d3860e] - (SEMVER-MINOR) dns: coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599
• [402682ed79] - doc: update readable.read() for v26 one-chunk behaviour (Fuma) #67341
• [dc4aa75983] - doc: add efekrskl to collaborators (Efe Karasakal) #67376
• [9695304ab8] - doc: add Philipp Dunkel to contributors (Philipp Dunkel) #67378
• [41db1f7b6b] - doc: add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377
• [ffed2aa208] - doc: fix process import in test runner workerId example (Daijiro Wachi) #67316
• [c685695fae] - doc: clarify process.loadEnvFile variable precedence (manjit singh) #67276
• [02f6efa9ed] - doc: fix security pre-alert template (Antoine du Hamel) #67240
• [96384231d5] - doc: fix execFile/execFileSync shell option docs (Paul Bouchon) #64437
• [ce1da53916] - doc: document C++ formatting in the pull request guide (Yuya Inoue) #67205
• [05902663d1] - doc: describe how the permission model grants the entrypoint (Rafael Gonzaga) #67038
• [3f12612157] - doc: correct DEP0199 runtime deprecation listing (Mike McCready) #67167
• [f5f18c704f] - doc: add LIEF to the dependency list (Yuya Inoue) #67165
• [6cffd6a9fd] - doc: ffi rename OS/400 -> IBM i (Abdirahim Musse) #67144
• [d3cf7a8b04] - doc: list CVE-2026-106072 in v24 changelog (inoway46) #66984
• [a806217855] - doc: list CVE-2026-106072 in v22 changelog (inoway46) #66984
• [5a5870066d] - doc: remove CI lockdown steps from security releases (Ulises Gascón) #67116
• [24d18ef520] - doc: clarify that V8 major upgrade uses stable release (Joyee Cheung) #67106
• [1cb68c9730] - doc: note linear history rule on branch-off (Rafael Gonzaga) #67057
• [7a3c6c564a] - doc: remove outdated platform note for --watch-path (yuki motokane) #66749
• [12a857a938] - doc: fix sqlite tagged template examples (Donghoon Kang) #66920
• [8570dfe348] - ffi: reject multi-argument buffer fast trampolines (Trivikram Kamat) #67046
• [a1bdd2dbbd] - ffi: reject signature conflicts from getFunctions getters (Trivikram Kamat) #67194
• [e64878bd2b] - ffi: support function calls from pointers (Damiano Mazzella) #66458
• [730e55a0f7] - ffi: make Fast API functions collectable (Trivikram Kamat) #67177
• [89db5c3e4c] - ffi: define function pointer property as own data property (Trivikram Kamat) #67170
• [7a24b2b9fc] - ffi: keep DynamicLibrary alive while callbacks are registered (Trivikram Kamat) #66842
• [883c6a68f2] - ffi: reject arguments after callback in registerCallback (Trivikram Kamat) #66997
• [1f63811af7] - ffi: accept -0 for int32 and uint32 arguments (Trivikram Kamat) #67035
• [78227c9a35] - ffi: free libuv error message on failed dlopen (Trivikram Kamat) #67007
• [0c5be929a5] - fs: keep readFile abortable on non-regular files (Christian Aurich Zanettini Martins) #66940
• [b9cdb3dbab] - fs: resolve symlinks before parent components (Jason Zhang) #65457
• [a30f200093] - fs: fix cpSync() abort when dest is a dangling symlink (Yohannes Desta) #67142
• [2d7c6c1983] - fs: fix readFileSync utf8 overflow on short reads (Christian Aurich Zanettini Martins) #66939
• [94c0e06803] - fs: do not swallow exceptions thrown by completion callbacks (Marco) #66308
• [b25b4960e0] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [6c5b08e1fc] - http: never execute llhttp re-entrantly (Matteo Collina) nodejs-private/node-private#1021
• [6c9747ff7b] - http: emit 'drain' after flushing coalesced chunks (junyup0503) #66782
• [6b8a90d41d] - (SEMVER-MINOR) http: batch body spans per parser execute (Guilherme Araújo) #67187
• [a947ae418e] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [e766c3db0e] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [46fd313a45] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [0eebafb726] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [be2898b11f] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [e1ae779fec] - http2: preserve multiple content-encoding values (Yuya Inoue) #67184
• [91a070d1d7] - http2: handle errors on compat push response streams (Matteo Collina) #67053
• [8d45d5b69e] - http2: exclude queued data from response memory checks (Yuya Inoue) #67114
• [ed688a4662] - http2: release queued data memory on stream cancellation (Yuya Inoue) #67113
• [0002058aa2] - http2: clear the session timeout before marking it destroyed (Huang-404-Q) #66886
• [69cca8726f] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [70d664a745] - inspector: fix out-of-bounds read in ws frame decoding (nashit hayat) #64618
• [1cc7ddc89f] - lib: replace Kahan summation with MathSumPrecise (Livia Medeiros) #67222
• [605b1f9c69] - lib: place value before done in iterator results (Kevin Gibbons) #66837
• [6ad44ecc50] - meta: bump rtCamp/action-slack-notify from 2.4.0 to 2.4.1 (dependabot[bot]) #67190
• [57ab9a4363] - meta: bump step-security/harden-runner from 2.21.1 to 2.22.3 (dependabot[bot]) #67191
• [044da7e905] - meta: bump cachix/install-nix-action from 31.11.1 to 31.11.3 (dependabot[bot]) #67019
• [3f639bd72c] - meta: bump ossf/scorecard-action from 2.4.4 to 2.5.0 (dependabot[bot]) #67020
• [5889278d22] - meta: bump actions/setup-python from 7.0.0 to 7.1.0 (dependabot[bot]) #67021
• [5757587d8e] - meta: bump actions/setup-node from 7.0.0 to 7.1.0 (dependabot[bot]) #67032
• [ed4fe08c01] - meta: bump actions/download-artifact from 8.0.1 to 8.0.2 (dependabot[bot]) #67018
• [481145443e] - meta: bump actions/upload-artifact from 7.0.1 to 7.0.2 (dependabot[bot]) #67024
• [dc4ef78fe3] - meta: bump github/codeql-action/init from 4.38.2 to 4.39.1 (dependabot[bot]) #67028
• [9b434b2f52] - module: avoid reparsing package.json in esm format detection (Gürgün Dayıoğlu) #66982
• [1eb7ba8575] - module: cache compiled WebAssembly modules in the compile cache (Guy Bedford) #66191
• [8cbc539c37] - net,tls: fix session reuse with provided sockets (Harjoth Khara) #64430
• [f2c56a628f] - node-api: fix crash on TSFN finalization reentrance at shutdown (Chengzhong Wu) #65967
• [5e1dad2e15] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [debf2daff1] - permission: prefer --permission over audit mode (Rafael Gonzaga) #67036
• [236355a392] - querystring: precompute Latin-1 escapes (Roberto Bianchi) #66756
• [ab9d401b4d] - quic: retain readers for readable streams (Dustin) #66407
• [d51e377a61] - quic: fix crypto error classification (Efe Karasakal) #66968
• [09718032b7] - quic: fix internal error code conversion (Efe Karasakal) #66967
• [26a8d53b92] - sea: mount the SEA VFS in workers at layer 0 (Manjeet Singh) #67239
• [8ffcb3ee55] - (SEMVER-MINOR) sea: generate a compile cache for the VFS modules (Matteo Collina) #66768
• [1774391f3e] - sqlite: add ReadOptionalString helper (Guilherme Araújo) #67042
• [0b223c67ec] - sqlite: use 64-bit result APIs for UDF return values (Guilherme Araújo) #67089
• [9c381d00b3] - sqlite: cache the SQLTagStore constructor template (Guilherme Araújo) #66912
• [c38a50365c] - sqlite: settle BackupJob through a single exit point (Guilherme Araújo) #66912
• [2ec332989b] - sqlite: use DeleteFnPtr for all SQLite handles (Guilherme Araújo) #66912
• [5bc98ec49d] - sqlite: track statements in the Statement constructor (Guilherme Araújo) #66912
• [464ab31405] - src: do not enable the inspector during snapshot building (Joyee Cheung) #67154
• [48428365fc] - src: make crypto backend checks explicit (Filip Skokan) #67056
• [9d86291e8b] - stream: trim webstreams sink wrappers and BYOB transfers (Matteo Collina) #66702
• [58eb15cd6b] - stream: fix pipeTo assert when writer is released during microtask (Qingyu Wang) #63733
• [c05a97a625] - stream: reject writes during WritableStream close (Matteo Collina) #67058
• [101e729044] - stream: keep async context of fromWeb writes (Matteo Collina) #67055
• [caa48a3302] - stream: keep async context of pipeTo watchers (Matteo Collina) #67052
• [6c7ff35f61] - test: fix X.509 generation with OpenSSL 4.1 FIPS (Filip Skokan) #67409
• [b0251889a8] - test: update WPT for WebCryptoAPI to e87deca336 (Node.js GitHub Bot) #67330
• [7667a8fd5b] - test: deflake test-runner-mock-timers-scheduler (Yuya Inoue) #67296
• [d6b8579deb] - test: deflake test-worker-eventlooputil (Matteo Collina) #67260
• [030c9536ab] - test: skip readFileSync pipe test without proc io (Jay) #67242
• [7b5b6fb2a3] - test: fix test-config-json-schema with --openssl-use-def-ca-store (Antoine du Hamel) #67200
• [8163152f5d] - test: use experimental flags in wpt tests (Aviv Keller) #67258
• [e858561f1a] - test: use valid PBKDF2 inputs in domain test (Filip Skokan) #67250
• [8ed89aad0b] - test: cover crypto digest and HMAC caches (Yagiz Nizipli) #67109
• [a7569c8d1b] - test: extend http2 cancellation coverage (fatih) #66784
• [04ffe27e00] - test: fix cluster dgram 1 test on macos (gegham1) #66986
• [df0f575044] - test: convert forEach to for of test-buffer-inheritance file (Antonio Duran) #67121
• [cbffa1a8d4] - test: replace for each with for of (Sergio Calderon) #67122
• [ed3bb858bd] - test: use spawnSyncAndAssert in nested async stack overflow test (Antonio Duran) #67123
• [6a561240f9] - test: convert .forEach to for...of (Jan Peer Stöcklmair) #67124
• [c89556683c] - test: convert .forEach to for...of in test-net-write-arguments.js (Emmanuel Florencio Trujillo) #67125
• [9e459f31c5] - test: convert for each to for of in test/parallel/test-net-server-close (Raymundo Lopez Santiago) #67127
• [2f799303ab] - test: use for...of in test-require-resolve-invalid-paths (Raul Garcia) #67128
• [10d1485965] - test: deflake test-worker-message-port-transfer-filehandle-fd0 (Christian Aurich Zanettini Martins) #66980
• [569ef753f4] - test: remove duplicate common imports (Livia Medeiros) #67088
• [bdbe9862ba] - test: add test for concurrent first use of OpenSSL (Christian Aurich Zanettini Martins) #66966
• [a04eeff08c] - test: use registerHooks() over module.register() (Geoffrey Booth) #67074
• [b08c226c6a] - test: update test426-fixtures to fae1fa49815813088c433e8486e330e8d953a44 (Node.js GitHub Bot) #66815
• [f1cb89b976] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [3fa5ee2923] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [1ddeffb2f8] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [7686e25c3b] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [ed11b570d5] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [40764cfdbe] - tls: reject hostnames with forbidden code points (Matteo Collina) #67254
• [754b3884c8] - tls: test the SPKI blocklist with a fixture key (Ulises Gascón) #66949
• [22ba5857c6] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [524341e94f] - tools: restore FIPS testing with default OpenSSL (Filip Skokan) #67248
• [6b6745a6f0] - tools: aggregate Nix changes in a table (Antoine du Hamel) #67348
• [ab1e78530c] - tools: update nixpkgs pins (Node.js GitHub Bot) #67334
• [576eef4d80] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318
• [ace3168084] - tools: use ubuntu-latest for public lint-js-and-md jobs (Yuya Inoue) #66409
• [edb6ab2fcc] - tools: warn when undici WPT report is missing (Filip Skokan) #67229
• [1686e8a99f] - tools: require value before done in iterator results (Kevin Gibbons) #66837
• [ae76a8be70] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #67189
• [ffac5539af] - tools: bump nixpkgs pins (Node.js GitHub Bot) #67173
• [2c2f6960dd] - tools: avoid rewriting same-version OpenSSL updates (Filip Skokan) #66999
• [356b720a46] - tools: remove node.gyp and node.gypi from v8.nix requisites (Antoine du Hamel) #66955
• [2f2d9c8d97] - tools: fix number comparison if Nix diff viewer (Antoine du Hamel) #66904
• [ead445d544] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #67025
• [9b99178707] - tools: bump piscina from 5.2.0 to 5.3.2 in /tools/doc (dependabot[bot]) #67026
• [5b8a2e0937] - tools: bump undici from 6.28.0 to 6.29.1 in /tools/doc (dependabot[bot]) #67027
• [b6e024af18] - tools: update gyp-next to 0.22.4 (Node.js GitHub Bot) #66988
• [908e3cd6ca] - tools: do not lint GYP JS files (Antoine du Hamel) #66988
• [2632ab72f3] - typings: fix internal type resolution (Seongeun Lee) #66512
• [2e27c83dd2] - typings: share Sign and Verify handle methods (Seongeun Lee) #66499
• [e2bf68811e] - url: use indexed appends in search params getAll (Roberto Bianchi) #66872
• [555bcfbbae] - util: use internal hexSlice directly in util.inspect() (Livia Medeiros) #66974
• [ec1e1e32d8] - v8: support X509Certificate serialization (Filip Skokan) #67083
• [dfb6dba9e3] - vfs: do not reuse the path of a loaded memfd image (Philipp Dunkel) #67068
• [6d44119d95] - vfs: place value before done in iterator result (LiviaMedeiros) #67231
• [76147a47c4] - vfs: forward the watchFile listener through RealFSProvider (Trivikram Kamat) #66224
• [819d9fdce6] - watch: track all dependencies of an owner (Christian Aurich Zanettini Martins) #66139
• [2bbcfa0718] - (SEMVER-MINOR) worker: preload streams into startup snapshot (Matteo Collina) #66311
• [d5a5280451] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
• [bf7bef4025] - zlib: avoid an extra empty zstd frame (Marco) #66161
• [0ddc6b787f] - zlib: restart format detection when resetting Unzip (Marco) #66169
• [209fb77c48] - zlib: grow the output buffer of large async one-shot calls (Yagiz Nizipli) #66863
• [86f2e27dff] - zlib: finish async convenience calls in one write (Yagiz Nizipli) #66863
• [997d0d6990] - zlib: skip the stream in sync convenience calls without options (Yagiz Nizipli) #66864