Node.js 26.9.0

I upgraded my test apps to Node.js 26.9.0 the day it dropped (September 16, 2026) so you can see whether this Current release is worth the jump. Verdict first: it is mostly a crypto upgrade cycle, but the new MAC API is genuinely useful.

The headline: a generic MAC API

Node 26.9.0 adds a SEMVER-MINOR generic MAC (message authentication code) interface to the crypto module. Instead of reaching for separate helpers per algorithm, you now get a single, unified way to compute and verify authentication tags across the supported algorithms. It cuts boilerplate and makes it easier to swap algorithms without rewriting your wrapping code.

• Generic MAC API added to crypto, unified across supported algorithms
• Private keys can now be loaded through an expanded set of paths
• Root certificates bumped to NSS 3.126 for current trust anchors

Worth it?

If you do TLS, JWT signing, or any HMAC-based work, the generic MAC API saves you a few lines and standardizes the approach. The NSS 3.126 root certificate refresh also means your TLS stack trusts the latest public CAs out of the box.

Migration notes

Node 26.9.0 is a Current-line release, not LTS. Test crypto paths in CI before promoting it to production, and keep an eye on the documented deprecations that accumulate between Current releases. Upgrade via your preferred version manager or the official binaries.