On September 8, 2026, the Node.js team shipped the new LTS release 24.21.0 “Krypton”, followed a day later by 26.8.2 on the Current line. Both bump OpenSSL to 3.5.8 and refresh their bundled root certificates.
Loading private keys from HSMs and cloud KMS
The headline feature of the 24.21.0 LTS is a SEMVER-MINOR addition to the crypto module: Node.js can now load private keys through so-called STORE loaders. That lets developers wire up hardware security modules (HSMs), PKCS#11 providers and cloud key-management services directly, keeping key material off the local disk in plaintext – a genuine win for security-conscious self-hosters.
OpenSSL, certificates and more
Both branches move OpenSSL to 3.5.8 and update root certificates to NSS 3.126. The LTS also folds in Undici 7.29.1, a faster net.BlockList, statistical hypothesis testing in perf_hooks and a non-throwing MIMEType.parse. The Current release 26.8.2 ships Undici 8.10.2 and refines the security posture of experimental features.
What it means for operators
Teams running the 24.x line in production should upgrade soon: “Krypton” enters its Maintenance phase in October 2026 and will then receive only security and critical bug fixes until April 2028. Homelab users benefit most from the new KMS integration, which previously required external libraries.
Sources: official release notes on nodejs.org (Node.js 24.21.0 “Krypton”, September 8, 2026) and the GitHub release page for v26.8.2 (September 9, 2026).
