Node.js 24.18.0 (LTS)

Richard Lau
2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa
Notable Changes
- [
e07e7a31e1
] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 - [
44c8ebcbd6
] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 - [
d3ef4122ee
] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 - [
bb2857b85a
] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527 - [
b9d5e87880
] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 - [
ccd756d61e
] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 - [
4c9251fc09
] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 - [
8c989ec4a3
] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079 - [
3f54c8ba32
] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834
Commits
- [
d3ef4122ee
] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 - [
9ff36e40f0
] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755 - [
7c22ee23aa
] - build: defNODE_USE_NODE_CODE_CACHE
only used in node_mksnapshot (Chengzhong Wu) #63588 - [
2551abdb4a
] - build,win: enable x64 PGO (Stefan Stojanovic) #62761 - [
e8a55ce9b1
] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763 - [
ae61cd68f3
] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363 - [
3d05a1d396
] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363 - [
f9d10a3f6b
] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363 - [
e431d93e9e
] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363 - [
56e2505e48
] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255 - [
3bac77f2a8
] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255 - [
1bff901b09
] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255 - [
4433fca3df
] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111 - [
b5cf01217a
] - crypto: harden KeyObject internal slots (Filip Skokan) #63111 - [
ce84aef37d
] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883 - [
26781689b0
] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905 - [
aeea8f4970
] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706 - [
407cf91656
] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626 - [
bb2857b85a
] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527 - [
b9d5e87880
] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 - [
b46d52b283
] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499 - [
ccd756d61e
] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 - [
e07e7a31e1
] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 - [
61826df455
] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531 - [
16d2fd3c07
] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280 - [
3b8330deda
] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576 - [
141de35399
] - debugger: add --help tonode inspect
and improve docs (Joyee Cheung) #63201 - [
b76bfcd4fa
] - deps: upgrade npm to 11.16.0 (npm team) #63602 - [
4ec142314c
] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525 - [
19e8ce1c36
] - deps: upgrade npm to 11.15.0 (npm team) #63463 - [
8a264260e2
] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217 - [
50c8ff3f94
] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811 - [
6e56f01c4b
] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136 - [
3ba813b242
] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222 - [
2390e3a5ac
] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650 - [
52a1c18374
] - doc: updategit node land
instructions for security releases (Antoine du Hamel) #63586 - [
3e6b4da037
] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583 - [
84d05163b9
] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479 - [
7da2a4450e
] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203 - [
3d79bd8b29
] - doc: clarifyfilter
option ofsqlite.database.applyChangeset
(Antoine du Hamel) #63515 - [
4f4174aace
] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511 - [
388323ca4b
] - doc: fix double space in modules.md (Daijiro Wachi) #63512 - [
5258ccc058
] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453 - [
43e83e6507
] - doc: fix typo in deprecations (Daijiro Wachi) #63434 - [
f05a61d54c
] - doc: remove unsupported template type from v8.md (René) #63410 - [
c39d5fc820
] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696 - [
398261f911
] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734 - [
fd9e14c405
] - doc: update http2'spush
andtrailers
events withrawHeaders
param (YuSheng Chen) #63259 - [
b943ce6933
] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329 - [
4b9cdfc022
] - doc: reference correct function in Module docs (Robin Malfait) #63247 - [
bed84b6df2
] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211 - [
32ea70569b
] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187 - [
4627bcfd82
] - doc: run license-builder (github-actions[bot]) #63232 - [
28eba71845
] - doc: add large pull requests contributing guide (Matteo Collina) #62829 - [
2648efd438
] - doc: remove unnecessary

Facts Only

* Node.js version: 24.18.0 ('Krypton', LTS).
* Release date: 2026-06-23.
* Notable crypto changes include adding TurboSHAKE and KangarooTwelve Web Cryptography algorithms.
* Updates involve aligning key argument names in documentation and error messages within the crypto module.
* The release includes dependency updates for npm (to versions 11.16.0 and 11.15.0), SQLite, simdjson, and V8 components.
* Specific cryptographic features were updated, such as accepting key data in crypto.diffieHellman() and wiring algorithms like ChaCha20-Poly1305 and AES-KW when using BoringSSL.
* The release involved hardening CryptoKey algorithm slots and key object internal slots.
* Documentation changes included fixing typos and clarifying usage instructions for various options and modules.

Executive Summary

The Node.js 24.18.0 release, version 'Krypton', was prepared by Richard Lau and was released on June 23, 2026. Notable changes involved updates to cryptographic functions, specifically concerning the integration of TurboSHAKE and KangarooTwelve Web Cryptography algorithms, along with adjustments to key argument naming in documentation and error messages across the crypto module. The release also included several dependency updates for npm, SQLite, simdjson, and V8 components, reflecting ongoing maintenance efforts. Several commits focused on hardening cryptographic implementations by accepting key data in Diffie-Hellman operations, strengthening checks within TurboSHAKE, and wiring specific algorithms like ChaCha20-Poly1305 and AES-KW within Web Cryptography when BoringSSL is used. Documentation updates included fixes for various typos and structural clarity across multiple files.

Full Take

This update reflects a significant focus on deepening the security primitives within the Node.js runtime, specifically around Web Cryptography and underlying cryptographic operations like Diffie-Hellman. The pattern observed is one of continuous, incremental hardening where core functionality is refined to address potential vulnerabilities exposed by evolving cryptographic standards. The extensive changes in the crypto module suggest an internal commitment to making advanced, cutting-edge algorithms (TurboSHAKE, KangarooTwelve) standard and robust within the environment.
The systematic dependency upgrades indicate a broader pattern of maintaining system integrity by addressing known security or stability issues across the entire software stack. This approach shifts the narrative from mere feature release to systemic resilience. The effort to align documentation and fix subtle errors demonstrates an awareness that security artifacts are not just code, but also clarity in communication. The implication is that building secure systems requires rigorous attention not only to new features but also to the meticulous refinement of existing, foundational mechanics across the entire dependency tree, ensuring that abstract cryptographic concepts translate into concrete, unassailable system guarantees.
What foundational assumptions about the stability of core mathematical operations versus their implementation details are being tested by these specific changes? What happens when systems rely on complex algorithms where the "how" (the implementation details) is as critical as the "what" (the algorithm name)? How does this focus on internal consistency inform broader architectural decisions for future, more complex software interactions?

Sentinel — Human

Confidence

This text appears to be highly structured, direct release notes for a software project, exhibiting characteristics of authentic developer documentation rather than synthesized news reporting.

Signals Detected

High lexical diversity and structural complexity indicative of technical reporting, despite the dense, highly structured nature.

The text is overwhelmingly a list of patch notes/commit logs, which naturally exhibits perfect internal coherence but lacks typical journalistic 'passion' or hedging.

The structure strongly mimics version control output, suggesting it is derived directly from a technical source rather than synthesized narrative.

Claims are presented as specific, verifiable technical updates and commit history, which is characteristic of official release notes, not fabricated news.

Human Indicators

The presence of numerous, specific, cryptographically related commit messages with individual author attributions (e.g., Matteo Collina, Filip Skokan) points toward a traceable source.

The use of standard software development terminology and versioning confirms an origin within the technical ecosystem.