NodeSource Weekly — Sept 22, 2026: Node.js 26.10.0, AI Security & NodeConf EU

by:

Estefany Aguilar

in newsletter on Sep 22 2026

👋 Welcome to This Week’s Edition!

Here’s what’s inside:

🟢 Node.js Releases: A look at Node.js 26.9.0 and the newly released Node.js 26.10.0, with updates across FFI, benchmarking, Web Workers, crypto, filesystem APIs, and performance tooling.
🚀 Featured from NodeSource: Why AI-assisted Node.js development can still introduce security risk when applications are built on outdated runtimes, vulnerable dependencies, or the wrong production baseline.
🌎 Community & Events: NodeConf EU 2026 is next week, with Rafael Gonzaga joining Antoine du Hamel to discuss the future of the Node.js release model, plus upcoming Node.js community meetings.
🤖 AI Corner: New developments in coding agents, real-time AI applications, and AI-powered security workflows from GitHub and Google.
🛠️ Node.js Upgrade Program: Resources and expert support for teams moving from End-of-Life Node.js versions to supported releases.

Happy reading! 🚀

🟢 Last Week in Node.js

Node.js 26 continues moving quickly, with two Current releases landing within a week and bringing new capabilities across crypto, benchmarking, FFI, workers, performance monitoring, and core utilities.

Node.js 26.9.0 — FFI, `node:bench`, Web Workers, and more

Node.js 26.9.0 landed on September 16 with several notable additions:

🔐 A new generic MAC API, plus discovery of ciphers and hashes from OpenSSL providers
🔌 The node:ffi module is now enabled by default
📊 A new built-in node:bench benchmarking API
📈 New perf_hooks histogram capabilities, including meanCI
🌐 An experimental DTLS API
📦 Virtual File System integration with both CommonJS and ESM module loaders
🧵 Support for Web Workers

This is a particularly feature-heavy Current release, with improvements spanning native interoperability, diagnostics, networking, and performance tooling.

Node.js 26.10.0 — New crypto, filesystem, and performance APIs

And just today, Node.js 26.10.0 arrived with another set of additions:

🔐 New crypto.parsePKCS12() support
📁 New fs.openAsBlobSync() API
🔌 FFI can now load libraries directly from a mounted VFS
🧵 net.BoundSocket can be sent to worker threads and child processes
📊 New SlidingWindowHistogram and histogram analysis capabilities in perf_hooks
🗃️ SQLite now binds JavaScript undefined values to SQL NULL
⚡ New util.throttle() and util.debounce() utilities

Node.js 26 remains the Current release line, while Node.js 24 (Krypton) remains the latest LTS line for production workloads.

🚀 Featured from NodeSource

🤖 Correct Code, Wrong Baseline: The Hidden Security Risk of AI-Assisted Node.js Development

AI can generate Node.js code that works — while still choosing an outdated runtime, vulnerable dependency, or unsafe production baseline.

Our latest article explores why AI-assisted development needs more than correct code. The runtime and dependency decisions made today can remain in Docker images, CI pipelines, templates, and production systems long after the original code ships.

Drawing on insights from Rafael Gonzaga, NodeSource Principal Open Source Engineer and Node.js TSC member, we look at:

🤖 How AI can influence Node.js runtime and dependency choices
⚠️ Why End-of-Life Node.js versions change the security equation
🔐 Why supported releases continue receiving fixes for vulnerabilities that did not exist when your application was written
🧑‍💻 Why developer environments are becoming part of the attack surface
🛠️ How is-my-node-vulnerable can validate your runtime against current Node.js security data

Correct code can still run on the wrong baseline.

👉 Read: Correct Code, Wrong Baseline →

🌎 Community & Events

🇮🇹 NodeConf EU 2026 is Next Week

NodeConf EU 2026 takes place September 29–30 in Bologna, Italy, bringing together the Node.js community for two days focused on runtimes, performance, observability, architecture, tooling, and production systems.

NodeSource’s Rafael Gonzaga, Principal Open Source Engineer and Node.js TSC member, will join Antoine du Hamel on September 30 for:

“The New Node.js Release Model: Why Node 27 Changes Everything”

The session will explore why the Node.js release process is changing, the challenges behind maintaining releases at ecosystem scale, and what the new model means for developers, maintainers, companies, and contributors.

👉 Explore NodeConf EU 2026

💚 Get Involved with the Node.js Community

Want to follow what’s happening inside the Node.js project? Several public community meetings are happening this week:

Diagnostics WG — September 24
Build WG — September 24
Node-API Team — September 25

Node.js project meetings are public and open to anyone interested in following discussions or contributing.

👉 See upcoming Node.js meetings

🤖 AI Corner

GitHub Copilot expands its agentic workflows

GitHub shipped another round of Copilot updates this week, including improved code review, smarter automatic model selection, Sentry integration, and additional agent capabilities in VS Code.

Developers can now tune auto model selection around efficiency, balance, or intelligence, depending on whether cost, latency, or model quality matters most.

GitHub also announced that several older Copilot models — including GPT-5.4, GPT-5.5, and Gemini 3.7 Flash — will be deprecated on October 19, with newer models recommended as replacements.

👉 Explore the latest GitHub Copilot updates

🎙️ Google launches new Gemini models for real-time voice apps

Google introduced Gemini 3.8 Live, Gemini 3.8 Live Extended Thinking, and Gemini 3.5 Transcribe for developers building voice-first applications.

The new models support real-time speech interactions through the Gemini API and Google AI Studio, while Gemini 3.5 Transcribe provides speech-to-text support across 85+ languages.

👉 Explore the new Gemini Audio models

🔐 Google is using AI agents to find vulnerabilities before production

Google shared how it is embedding AI-powered security agents directly into its software development lifecycle to scan code changes, identify vulnerabilities, and generate fixes.

According to Google, the system continuously analyzes hundreds of millions of lines of infrastructure code and is helping prevent hundreds of vulnerabilities per month from reaching its codebase or production environments.

It’s another signal that AI agents are moving beyond code generation toward continuous security analysis and remediation inside the development lifecycle.

👉 Read how Google is using AI agents for infrastructure security

🚀 Node.js Upgrade Program

Free Expert Help for Your Next Node.js Upgrade

Still running an End-of-Life version of Node.js?

The Node.js Upgrade Program, developed in partnership with the OpenJS Foundation, helps organizations migrate to supported LTS releases with free expert guidance from the Node.js ecosystem.

You can follow the step-by-step upgrade process yourself using the program's resources, or request assistance from the Upgrade Program team to help plan and execute your migration.

The program is designed to help organizations:

✅ Upgrade from End-of-Life Node.js versions
✅ Reduce security and compliance risks
✅ Plan migrations with confidence
✅ Modernize production applications

Participation is completely free for organizations.

🔗 Learn more and get started:
https://nodesource.com/products/nodejs-upgrade

⚡ Stay Connected

The Node.js ecosystem never stands still—and neither do we.

Subscribe to stay up to date with future editions featuring the latest Node.js releases, AI-powered developer tools, observability, security, and community news.

Have questions, feedback, or ideas for a future edition? We'd love to hear from you.

📩 Contact NodeSource
📧 teffcode@nodesource.com

See you next month! 👋

The NodeSource Blog