Blog / 01

Node.js 24.19.0 LTS Adds TLS Certificate Compression

WebRestart

On August 3, 2026 the Node.js project shipped v24.19.0 'Krypton' (LTS) alongside v26.6.0 on the Current line. This is a feature release, not a security one — everything in it is SEMVER-MINOR, so upgrading within the 24.x line is a rebuild rather than a migration. The headline additions are TLS certificate compression, caller-supplied buffers for readFile(), and a configurable HTTP header validation switch.

Worth being clear about what this is not: it is not the July 29 security release that patched 11 CVEs. If you already jumped to 24.18.1 for those fixes, you are patched — 24.19.0 is the follow-on feature drop. If you skipped both, you now get the CVE fixes and the new APIs in one move.

What landed on the LTS line

TLS certificate compression

tls gains a certificateCompression option, backed by an OpenSSL build configuration change that enables compression support (both by Tim Perry, #62217). Compressing the certificate chain during the handshake cuts bytes on the wire at connection setup. That matters most where handshakes are frequent and chains are fat — mutual TLS between services, or a public endpoint with a long intermediate chain and a lot of cold clients.

Alongside it, tls now reports the negotiated TLS groups (Filip Skokan, #64119). Small, but it turns "which curve did we actually agree on" from a tcpdump exercise into a property you can log.

Caller-supplied buffers in readFile()

fs.readFile() can now take a buffer you provide (Matteo Collina, #63634). Previously every read allocated a fresh buffer sized to the file. For a service reading the same set of files repeatedly — templates, config, static assets served outside a CDN — you can now hand it a reused buffer and stop generating garbage on a hot path.

This is the kind of change that does nothing for most apps and quite a lot for a specific few. If file reads show up in your allocation profile, it is worth the ten-minute experiment. If they do not, ignore it.

httpValidation

http gains an httpValidation option to configure header value validation (RajeshKumar11, #61597). Node's strictness about header values has historically been all-or-nothing, which is a problem when you have to interoperate with a legacy upstream that emits something technically out of spec.

Treat this as an escape hatch, not a default. Loosening header validation is exactly the kind of knob that shows up in a request-smuggling write-up two years later. If you turn it down, write down why, and scope it to the one client that needs it.

Keep-alive tuning

socket.setKeepAlive() now supports TCP_KEEPINTVL and TCP_KEEPCNT (Guy Bedford, #63825). Node could already set the idle time before the first probe; now you can control the interval between probes and how many failed probes kill the connection.

If you have ever had a pool of sockets to a database or an upstream API quietly go stale behind a NAT or a cloud load balancer with an idle timeout, this is the setting you wanted. Detection time is now something you can compute instead of something you inherit from the kernel defaults.

The smaller additions

  • blob.textStream() — stream text out of a Blob without materialising the whole string (Matthew Aitken, #64036)
  • ReadableStreamTee is now exposed (Matteo Collina, #64195)
  • --experimental-import-text — import text files as strings from ESM (Efe, #62300)
  • perf_hooks samples event loop delay per iteration rather than on an interval (Pablo Erhard, #62935)
  • An empty --experimental-config-file value is now permitted (Marco Ippolito, #61610)

Two stability bumps are quietly the most useful line items for anyone maintaining production code: stream.compose is now stable (Matteo Collina, #62562), and blockList moves up to release candidate (alphaleadership, #63050). If your team has a rule against experimental APIs in production — and it should — stream.compose just cleared it.

And on the Current line

Node.js 26.6.0 shipped the same day. Its own SEMVER-MINOR highlights are narrower: ffi adds getCurrentEventLoop (Paolo Insogna, #64323), and the test runner gains context.log() with a matching test:log event plus an entryFile field in TestStream events (both Moshe Atlow, #64389 and #64309).

Node 26 is Current, not LTS. It is the right place to try the new FFI and test-runner surface; it is not where your production API should live.

What to do

For most teams the answer is: take 24.19.0 on the next routine rebuild, and do not treat any of these APIs as urgent. Nothing here is a security fix, and nothing here is breaking.

node --version
docker run --rm node:24-alpine node --version

The exceptions worth scheduling deliberately are the keep-alive controls, if you have a stale-socket problem you have been living with, and certificateCompression, if you terminate a lot of mTLS handshakes. Both are configuration changes with measurable before-and-after numbers, which makes them easy to justify and easy to revert.

Full details are in the Node.js 24.19.0 release notes and the 26.6.0 notes.

Running a Node estate where nobody is quite sure which version is where? Talk to us — runtime audits and upgrade paths, without the three-month project.

All posts