●Change8

Migrating to Node.js v25.3.0

Version v25.3.0 introduces 2 breaking changes. This guide details how to update your code.

Released: 1/13/2026

2
Breaking Changes
2
Migration Steps
7
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

TLSSocketpipe_wrapsymlink APIsfutimesasync_hooksunsafe buffer creationtls callbacks

Breaking Changes

●Issue #1

Refactor of unsafe buffer creation removed the zero-fill toggle. Code relying on this toggle for buffer initialization behavior may need adjustment.

●Issue #2

The `futimes` operation is now disabled when the permission model is enabled. Code using `futimes` in permission-enabled contexts will fail.

Migration Steps

  1. 1
    If relying on the zero-fill behavior of unsafe buffer creation, ensure buffers are explicitly zero-filled if necessary, as the toggle was removed.
  2. 2
    If using `futimes` in environments where the permission model is active, this function call will now be blocked.

Release Summary

This is a security release addressing several CVEs across lib, permission, src, and tls modules. Key changes include improved error handling and stricter permission checks.

Need More Details?

View the full release notes and all changes for Node.js v25.3.0.

View Full Changelog