Node.js 26.10.0 adds PKCS#12 parsing, throttle and debounce in util
Serguey Asael Shinder1 min readNode.js 26.10.0 landed on 22 September 2026 on the Current line, released by Antoine du Hamel. The notable list is unusually wide for a minor, and most of it is semver-minor additions rather than fixes.
In crypto there is a new crypto.parsePKCS12(). In util two functions arrive that every codebase has previously carried its own copy of: util.throttle and util.debounce, both from James M Snell, plus util.markPromiseAsHandled. The fs module gains openAsBlobSync, and net can now send a net.BoundSocket to threads and child processes.
Two entries are worth separating from the rest. The ffi module can load libraries from a mounted virtual filesystem, contributed by Matteo Collina. And perf_hooks picks up a SlidingWindowHistogram along with qrde analysis support in Histogram.
Among the plain commits the crypto section is doing steady structural work: reading RSA-PSS restrictions from the provider, decoding PKCS#1 keys through providers, deriving keys through EVP_KDF, and adding hybrid KEMs to Web Cryptography. There is also a fix for unaligned UTF-16LE decoding in buffer.
What it means
throttle and debounce in the standard library are the entry most teams will feel. They are trivial to write and almost always written slightly wrong — leading versus trailing edge, cancellation, what happens to the pending call on shutdown. A single implementation with documented semantics removes a small recurring argument from code review.
The ffi-from-a-mounted-VFS change points somewhere else entirely: packaging. Loading native libraries out of a virtual filesystem is what single-file and sandboxed distributions need, and it is the kind of capability that quietly decides whether a deployment story is possible at all. Current is not LTS, so none of this is available to a production line yet; the useful move now is to test against it rather than to adopt it.