--- title: Node.js — Node.js 26.5.0 (Current) | daily.dev description: Node.js 26.5.0 (Current) has been released with several semver-minor additions: blob.textStream() on the buffer API, a new --experimental-import-text flag for... canonical: https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Node.js — Node.js 26.5.0 (Current) | daily.dev og:description: Node.js 26.5.0 (Current) has been released with several semver-minor additions: blob.textStream() on the buffer API, a new --experimental-import-text flag for... og:url: https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz og:image: https://api.daily.dev/og/posts/OiVEPA9rz.png og:image:alt: Node.js — Node.js 26.5.0 (Current) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Node.js — Node.js 26.5.0 (Current) **[Node.js](https://daily.dev/sources/nodejs)** · 11 min read · 142 upvotes · 4 comments ## Summary Node.js 26.5.0 (Current) has been released with several semver-minor additions: blob.textStream() on the buffer API, a new --experimental-import-text flag for ESM, per-event-loop-iteration delay sampling in perf_hooks, ReadableStreamTee exposure on streams, and TLS negotiated group reporting. The release also includes numerous bug fixes across HTTP, crypto (rejecting small-order EdDSA points, large DH generator validation), streams (abort signal handling, WHATWG stream overhead reduction), VFS improvements, and dependency updates (undici 8.7.0, SQLite 3.53.3, V8 backports). A new releaser, Stewart X Addison, has been added with his GPG release key. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What new features were added in Node.js 26.5.0? Node.js 26.5.0 adds several semver-minor features: blob.textStream() in the buffer module, an --experimental-import-text ESM flag, per-event-loop-iteration delay sampling in perf_hooks, an exposed ReadableStreamTee in the stream module, and TLS negotiated group reporting. It also introduces a new releaser, Stewart X Addison, whose GPG key may sign future release builds. _Track new Node.js runtime capabilities like these on daily.dev before they hit your build._ ### Does Node.js 26.5.0 include any security-related fixes? Yes, it includes several crypto and TLS hardening fixes: large Diffie-Hellman generator validation, rejection of small-order EdDSA points during verification, handling of large RSA exponents in X.509 certificates, and validation of flush kind for zlib and brotli streams. None are flagged as urgent CVE patches, but they tighten cryptographic edge-case handling. _Developers auditing crypto behavior across Node.js releases follow patch details like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 14 upvotes > The quietly useful one here is the text-import flag — pulling .txt/.sql/HTML template files in as first-class ESM modules instead of the `fs.readFileSync(new URL('./tpl.html', import.meta.url))` dance every ESM codebase reinvents. Because it's a static import, bundlers can actually trace it, which kills a whole class of 'file not found once bundled' bugs for anyone shipping SQL or templates next to their code. Good to see it land even behind a flag. **@ajaychoudhary80** · 0 upvotes > The stream and `perf_hooks` enhancements look particularly useful for production applications. **@gaburayondev** · 0 upvotes > The EdDSA small-order point rejection fix is the real headline here IMO — quietly important for crypto security. `--experimental-import-text` is one to watch too. Solid release. ## Similar posts on daily.dev - [Node.js — Node.js 24.19.0 \(LTS\)](https://daily.dev/posts/node-js-node-js-24-19-0-lts--nucatzks7) · Node.js · 9 upvotes · 0 comments - [Node.js — Node.js 26.4.0 \(Current\)](https://daily.dev/posts/node-js-node-js-26-4-0-current--oee6dtjav) · Node.js · 75 upvotes · 4 comments - [Node.js — Node.js 26.2.0 \(Current\)](https://daily.dev/posts/node-js-node-js-26-2-0-current--babcovtzb) · Node.js · 78 upvotes · 6 comments - [Node.js — Node.js 26.0.0 \(Current\)](https://daily.dev/posts/node-js-node-js-26-0-0-current--xsccfs0nf) · Node.js · 98 upvotes · 1 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs) [View this post on daily.dev](https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Node.js — Node.js 26.5.0 (Current)","url":"https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz"},"datePublished":"2026-07-08T12:24:32.401Z","dateModified":"2026-09-14T06:35:51.781Z","description":"Node.js 26.5.0 (Current) has been released with several semver-minor additions: blob.textStream() on the buffer API, a new --experimental-import-text flag for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6305eeea6df1a79a0c3e07bf47219070?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6305eeea6df1a79a0c3e07bf47219070?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Node.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Node.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/nodejs","url":"https://daily.dev/sources/nodejs"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":142},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"javascript,nodejs","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Node.js","item":"https://daily.dev/sources/nodejs"},{"@type":"ListItem","position":3,"name":"Node.js — Node.js 26.5.0 (Current)"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz","comment":[{"@type":"Comment","text":"The quietly useful one here is the text-import flag — pulling .txt/.sql/HTML template files in as first-class ESM modules instead of the fs.readFileSync(new URL('./tpl.html', import.meta.url)) dance every ESM codebase reinvents. Because it’s a static import, bundlers can actually trace it, which kills a whole class of ‘file not found once bundled’ bugs for anyone shipping SQL or templates next to their code. Good to see it land even behind a flag.","datePublished":"2026-07-08T18:03:55.969Z","url":"https://daily.dev/posts/OiVEPA9rz#c-vBKrUJI3R","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":14}},{"@type":"Comment","text":"The stream and perf_hooks enhancements look particularly useful for production applications.","datePublished":"2026-07-12T06:25:43.601Z","url":"https://daily.dev/posts/OiVEPA9rz#c-qprRUkHx6","author":{"@type":"Person","name":"Ajay Choudhary","url":"https://daily.dev/ajaychoudhary80","image":"https://media.daily.dev/image/upload/s--WkX8wDW2--/f_auto/v1780989706/avatars/avatar_QNZlI2SgVnNSx5PSRpCVx?_a=BAMAMiWQ0"}},{"@type":"Comment","text":"The EdDSA small-order point rejection fix is the real headline here IMO — quietly important for crypto security. --experimental-import-text is one to watch too. Solid release.","datePublished":"2026-07-11T13:31:44.344Z","url":"https://daily.dev/posts/OiVEPA9rz#c-iijjcERFU","author":{"@type":"Person","name":"Gabu Rayon Dev","url":"https://daily.dev/gaburayondev","image":"https://media.daily.dev/image/upload/s--5hPC52y_--/f_auto/v1773412842/avatars/avatar_8fkdziGASnSSBES6c4Ml9?_a=BAMAMiiu0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/node-js-node-js-26-5-0-current--oivepa9rz#faq","mainEntity":[{"@type":"Question","name":"What new features were added in Node.js 26.5.0?","acceptedAnswer":{"@type":"Answer","text":"Node.js 26.5.0 adds several semver-minor features: blob.textStream() in the buffer module, an --experimental-import-text ESM flag, per-event-loop-iteration delay sampling in perf_hooks, an exposed ReadableStreamTee in the stream module, and TLS negotiated group reporting. It also introduces a new releaser, Stewart X Addison, whose GPG key may sign future release builds. Track new Node.js runtime capabilities like these on daily.dev before they hit your build."}},{"@type":"Question","name":"Does Node.js 26.5.0 include any security-related fixes?","acceptedAnswer":{"@type":"Answer","text":"Yes, it includes several crypto and TLS hardening fixes: large Diffie-Hellman generator validation, rejection of small-order EdDSA points during verification, handling of large RSA exponents in X.509 certificates, and validation of flush kind for zlib and brotli streams. None are flagged as urgent CVE patches, but they tighten cryptographic edge-case handling. Developers auditing crypto behavior across Node.js releases follow patch details like these on daily.dev."}}]} ```