Node.js 26.6.0

Node.js 26.6.0 landed on August 3, 2026, and on paper it looks like a tidy little maintenance release. As usual, the interesting part is what the release notes don't advertise in big letters.

What Actually Changed

The headline items are two additions to the test runner. context.log() and the new test:log event let you emit structured output from inside tests without polluting assertion output, and TestStream events now report the entryFile so CI tooling can trace results back to the file that ran them. Both are genuinely useful — if you're the kind of person who feeds test output into a dashboard.

The FFI module picks up getCurrentEventLoop, which gives native addon authors a way to grab the current event loop handle. Niche, but real.

The Crypto Split Is the One to Watch

Under the hood, the crypto implementation has been split into OpenSSL 3, BoringSSL, and legacy backends. That's a big refactor to ship in a point release, and it's the kind of change that usually surfaces as "works fine in our CI, breaks on someone's custom OpenSSL build." If you compile Node against a nonstandard OpenSSL, test this one before you roll it out.

There are also a few RSA-PSS fixes — legacy public key DER is now preserved, incomplete private keys are handled instead of crashing — plus a new 512-byte cap on KangarooTwelveParams customization strings. The cap is a correctness/security hardening measure; if you were pushing more than 512 bytes of customization through K12, that code path just changed behavior.

Small Fixes, Real Impact

The Blob.stream() source-buffer leak is closed, and lone \r characters in Blob line endings are normalized properly. Both are the kind of thing that bites in production under memory pressure. There's also a fix for a TypeError on Maps with null keys in assert/util.

One cosmetic change worth noting: node --help output is now styled with util.styleText. Harmless, but if you parse help output in scripts, your parsers might see ANSI codes they didn't see before.

The Verdict

Upgrade for the security hardening and the test-runner additions. But if you depend on custom crypto builds, don't upgrade blindly — run your full native-addon test suite first. This one deserves the extra five minutes.