Quick take: Node.js 24.18.0 is an LTS patch release, shipped June 23, 2026, that focuses on security hardening rather than new features. Root certificates moved to NSS 3.123.1, several structures were hardened against prototype pollution, and BoringSSL added post-quantum ML-DSA and ML-KEM support. Buffer.poolSize also jumped from 8 KiB to 64 KiB. Nothing here changes how your code runs, so upgrade in a branch, run your tests, and ship.
Node.js 24.18.0 is a Long-Term Support patch release for the v24 "Krypton" line that bundles security hardening, updated root certificates, and dependency bumps rather than new language or runtime features.
Why Is Node.js 24.18.0 Such a Boring Release?
Node.js 24.18.0 is the June 2026 patch release in the v24 "Krypton" LTS line, and it's built almost entirely from security fixes, updated root certificates, and dependency bumps rather than new features. Node.js 24.18.0 came out on June 23, 2026, and if you skimmed the release notes you'd be forgiven for closing the tab. There's no headline feature here. No new global, no syntax you'll rewrite code for. It's crypto hardening, updated root certificates, and dependency bumps.
That's a good thing. This is the v24 "Krypton" line, the active Long-Term Support release, and LTS updates are supposed to be dull. You want the version running your production traffic to change as little as possible while quietly closing security holes. So let me pull out the handful of entries that actually matter.
What Security Work Landed in Node.js 24.18.0?
Most of 24.18.0 sits under the crypto and TLS umbrella. Root certificates got updated to NSS 3.123.1, which keeps your outbound HTTPS connections trusting the right certificate authorities. That alone is worth the upgrade, because stale root stores are the kind of thing nobody notices until a cert chain breaks.
Beyond that, the release hardens several internal structures against prototype pollution, a class of attack where a malicious object messes with prototypes it shouldn't touch. Node tightened the WebCrypto layer, CryptoKey algorithm slots, and KeyObject internal slots specifically. If you handle keys or run WebCrypto in any exposed path, this is quietly protecting you.
Prototype pollution is an attack class where an attacker modifies the properties of Object.prototype, or another shared prototype, so that unrelated code reading that property later gets the attacker's value instead of the expected one. Post-quantum cryptography, represented here by the ML-DSA and ML-KEM algorithms, refers to cryptographic schemes designed to remain secure even against an adversary running a sufficiently powerful quantum computer.
There's also forward-looking crypto. The release adds the TurboSHAKE and KangarooTwelve algorithms to the Web Cryptography API, and the bundled BoringSSL picked up support for the post-quantum ML-DSA and ML-KEM schemes. You probably won't touch these tomorrow. But post-quantum readiness landing in an LTS release means it'll be there, stable, when you do need it.
What Are the Two Changes You Might Actually Feel?
Two entries are marked SEMVER-MINOR, meaning they add capability without breaking anything.
First, the default Buffer.poolSize went up to 64 KiB. Node keeps a small internal pool for tiny buffer allocations, and a bigger pool means fewer trips to the allocator on workloads that churn through small buffers. Is this going to transform your throughput? No. But it's a free efficiency nudge for parsing-heavy or streaming code. The only thing to watch is a marginally higher memory floor in tight containers.
Second, HTTP gained a writeInformation method to send arbitrary 1xx status codes. If you've ever wanted to send a 103 Early Hints response to let a browser start preloading assets before your real response is ready, this is the clean way to do it. Niche, but genuinely useful for performance-minded APIs.
Rounding it out: the bundled npm moved to 11.16.0 and the embedded SQLite was patched to 3.53.1. The inspector can now expose precise coverage start to the JS runtime, which matters if you build tooling on top of Node's coverage data.
I keep a small checklist for releases like this, and it's short: does anything change how my code runs, does anything close a hole I care about, and does anything move a bundled dependency I pin. Here the answer is no, yes, and yes. That combination is my cue to upgrade without a second thought. The releases I slow down for are the ones that touch module resolution or the HTTP defaults, because those are where a silent behavior change hides. A crypto-and-dependencies patch like 24.18.0 doesn't carry that risk, so it goes straight to the front of the queue.
What Changed in Node.js 24.18.0 at a Glance?
| Area | Change | Impact |
|---|---|---|
| Root certificates | Updated to NSS 3.123.1 | Keeps outbound HTTPS trusting the right CAs |
| Prototype pollution hardening | WebCrypto, CryptoKey, KeyObject internal slots | Security fix, no code changes needed |
| Post-quantum crypto | ML-DSA and ML-KEM added to bundled BoringSSL | Forward-looking, not yet in common use |
| Buffer.poolSize | Default raised from 8 KiB to 64 KiB (SEMVER-MINOR) | Fewer allocator trips, slightly higher memory floor |
| HTTP writeInformation | New method for sending 1xx responses like 103 Early Hints | Additive, opt-in for performance-minded APIs |
| Bundled npm | Updated to 11.16.0 | Dependency bump |
| Bundled SQLite | Patched to 3.53.1 | Dependency bump |
Should You Upgrade?
If you're already on the v24 line, yes, and without much ceremony. Patch and minor updates inside a major version are backward compatible, so upgrade in a branch, run your tests, and ship. There's no behavior change waiting to bite you here.
Here's my actual checklist for deciding whether to take a Node.js patch release immediately:
- Check whether it's a patch or minor bump within your current major version. 24.18.0 is, so backward compatibility is guaranteed by semver.
- Check the changelog for anything marked SEMVER-MINOR. This release has exactly two, the Buffer pool size and the new writeInformation method, both additive.
- Check if it touches module resolution or HTTP defaults. Those are the categories most likely to hide a silent behavior change; this release touches neither.
- Check your bundled dependency pins, like npm and SQLite, against the release notes if you track them separately in your own tooling.
If you're still on Node 20 or 22, 24.18.0 isn't the reason to jump, but it's a reminder that the v24 LTS line is stable and getting steady security attention. Just don't treat a patch release as a migration guide. The move from 20 to 24 removes require() for ES modules and drops several legacy globals, and none of that shows up in a 24.18.0 changelog. If that's your path, read our Node.js 20 to 24 migration guide first. Planning to drop ts-node while you're at it? Node 24's native TypeScript support pairs nicely with the upgrade.
The short version: 24.18.0 is a maintenance release doing maintenance work. Install it, move on, and appreciate that your runtime spent its energy on your security instead of your changelog.
Update, August 4, 2026: The v24 line has already moved past this release. Node.js 24.19.0 landed on August 3, 2026, and nothing in it changes the advice above, it's the same kind of quiet maintenance bump. If you're installing fresh today, grab 24.19.0 rather than pinning to 24.18.0 specifically; everything on this page about the Krypton LTS line and the upgrade posture still holds.
Update, September 6, 2026. 24.20.0 breaks the pattern this article describes. Node.js 24.20.0 shipped on August 26, 2026, and it is not a boring release. It carries eight SEMVER-MINOR entries, which is more feature surface than the previous several v24 releases combined:
| Change | Why it matters |
|---|---|
using scopes in AsyncLocalStorage | Explicit resource management applied to context propagation, so a store can be scoped by a using declaration instead of a callback |
| Package maps in the loader | Module resolution, which is exactly the area I said above I slow down for |
permission.drop and --permission-audit | The permission model gets a way to shed capability at runtime and a way to see what a process actually asked for |
node:stream/iter | A dedicated iterator surface for streams, landing in LTS rather than Current |
| WASM JSPI enabled | JavaScript Promise Integration, no longer behind a flag |
context.log() and test:log in the test runner | Structured per-test logging that reporters can consume |
buffer gains an end parameter | Additive, but it sits alongside three separate Blob and indexOf bug fixes |
| Root certificates to NSS 3.125 | The same maintenance work 24.18.0 did, one store version later |
So does that contradict the point of this article? Not quite, but it complicates it. My rule above was that I upgrade patch releases without a second thought and slow down for anything touching module resolution. 24.20.0 touches module resolution, inside an LTS line, at a minor bump. It's still backward compatible by semver, and package maps are opt-in. I'd still take it. I'd just read the changelog first instead of skimming it, which is not what I said about 24.18.0.
If you're installing fresh today, 24.20.0 is the v24 release to grab. Node 26.8.1 is the Current line as of late August, and it is not where production traffic belongs.