●Change8

Migrating to Node.js v24.13.0

Version v24.13.0 introduces 2 breaking changes. This guide details how to update your code.

Released: 1/13/2026

2
Breaking Changes
2
Migration Steps
6
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

TLSSocketfutimessymlink APIsasync_hooksunsafe buffer creationtls

Breaking Changes

●Issue #1

Refactor of unsafe buffer creation removed the zero-fill toggle, which might affect code relying on this specific behavior for buffer initialization.

●Issue #2

Symlink APIs now require full read and write permissions, potentially breaking scripts that previously operated with fewer permissions.

Migration Steps

  1. 1
    Ensure applications using unsafe buffer creation are aware that the zero-fill toggle has been removed.
  2. 2
    Verify that processes interacting with symlink APIs have full read and write permissions, as required by CVE-2025-55130.

Release Summary

This is a security release addressing several CVEs across various components including TLS, lib, and src. Key fixes involve error handling, permission requirements for symlinks, and buffer creation refactoring.

Need More Details?

View the full release notes and all changes for Node.js v24.13.0.

View Full Changelog