Node.js 26.7.0

Release Date: August 5, 2026

Node.js 26.7.0 just dropped and honestly, the crypto folks did not come to play this week. I spent the morning poking at the new release and there is a lot to unpack — from STORE loaders for private keys to a test runner flag that finally makes coverage easy.

TL;DR

Private keys can now be loaded through STORE loaders — big deal for HSM and PKCS#11 setups
Root certificates refreshed to NSS 3.125
Perfetto support lands in the runtime
Symbol.dispose is now implemented in ModuleHooks
npm bundled is bumped to 11.19.0

Crypto Gets Its Glow-Up

The headline change is SEMVER-MINOR: private keys can now be loaded through STORE loaders. If you have ever wrestled with feeding keys out of a hardware token into Node, you know why this matters. No more awkward detours through files or raw buffers.

There are also a bunch of small but spicy crypto fixes: Argon2 can no longer sneak around FIPS mode (oops), KDF failures now preserve the underlying OpenSSL errors instead of swallowing them, and DH operation failures finally get handled properly.

Perfetto Is Here

Perfetto support landed in the lib, which means you can now trace Node.js the same way you trace Chrome and Android. The perfetto-sdk build flag is in, and CI runs perfetto build and test on GitHub Actions. Profiling just got a whole lot more interesting.

Test Runner Wants You to Measure Everything

--test-coverage-include-all is the new flag in the test runner, and yes, it does what it says: include all files in coverage, not just the ones that got imported. Your coverage numbers are about to get honest, and honestly? That is a good thing.

Under the Hood

ngtcp2 jumped to 1.25.0 and nghttp3 to 1.18.0, so QUIC/HTTP3 people should be happy. Blob slicing uses Clamp conversion now, and the buffer code validates copyArrayBuffer offsets against the real buffer length. Rustc requirement got bumped to >=1.86 for the build.

Should You Update?