Node.js 26.10.0 has shipped utilities including debounce, throttle, and a crypto API for parsing PKCS#12 certificates directly into the runtime's standard library, reducing reliance on third-party packages.
The new version of the open-source JavaScript runtime introduces util.debounce() and util.throttle() in the node:util module, addressing rate-limiting functionality that was previously obtained from packages such as lodash or throttle-debounce. The additions were landed by James M Snell, with Matteo Collina noting he uses these utilities in “essentially every app.”
Contributors ljharb and bakkot highlighted the awkwardness of using an AbortSignal inside a function meant to be called repeatedly, so Snell reworked the signal to cancel every future invocation and added a leading-edge option for immediate first-call fire.
Alongside these, util.markPromiseAsHandled() provides an explicit mechanism for framework authors to signal to the runtime that a promise has been handled, addressing a long-running source of confusion around unhandled-rejection signalling.
The crypto.parsePKCS12() API wraps OpenSSL’s d2i_PKCS12_bio() and PKCS12_parse(), returning an object with privateKey, certificate, and additionalCertificates fields, removing the need to rely on the OpenSSL CLI or packages like node-forge. The change was Brian Muenzenmeyer’s first significant core contribution touching C++, refined with Filip Skokan.
Node.js has also extended its experimental Virtual File System into node:ffi, allowing libraries to load straight from a mounted VFS using the same self-cleaning anonymous memfd trick native addons use under Linux. The patch also fixed a bug where dlopen forwarded an undefined flags argument, which silently broke addon loading from the real filesystem.
Compared with Bun and Deno, both of which have tended to ship richer standard libraries by default, this run of additions continues a visible trend in Node.js of reducing reliance on userland utilities. The shift also has supply-chain implications, cutting a handful of small dependencies out of typical node_modules trees.
Node.js 26 has now moved to Active LTS under the codename “Lithium” with support through April 2029. Node.js is an open-source, cross-platform JavaScript runtime maintained under the OpenJS Foundation.
Analysis
Why This Matters
- Reduces the need for third-party packages like lodash and throttle-debounce for common utilities, simplifying project dependencies and supply chains.
- Simplifies TLS and certificate handling in Node.js applications by exposing PKCS#12 parsing natively, removing dependency on external tools or libraries.
- The trend towards a richer standard library brings Node.js closer in feature parity to competitors like Bun and Deno, lowering the barrier for developers adopting the runtime.
Background
Node.js is a widely-used open-source JavaScript runtime for server-side and application development. Historically, its standard library was intentionally minimal, relying on a large ecosystem of third-party packages via npm. This approach has changed in recent years, with the team adding more built-in functionality. The new features land on the Current release line and have now transitioned to Active LTS status under Node.js 26, codenamed “Lithium,” ensuring long-term support through April 2029.
Key Perspectives
James M Snell: Landed the debounce and throttle helpers in a single pull request.
Matteo Collina: Noted he uses these utilities in “essentially every app” and co-extended the Virtual File System into node:ffi.
Contributors ljharb and bakkot: Flagged the awkwardness of using an AbortSignal inside a repeatedly called function, leading to a rework of the signal handling and the addition of a leading-edge option.
Brian Muenzenmeyer: Made his first significant core contribution by implementing crypto.parsePKCS12(), refined with Filip Skokan.
What to Watch
- Adoption rates of the new built-in utilities among major npm packages, particularly where lodash’s debounce/throttle are heavily used.
- Further extensions to the Virtual File System in
node:ffi, which could enable additional native library loading patterns.
- Next features in Node.js 26 releases as part of the Active LTS cycle, which may include more commonly vendored dependencies.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedNode.js 26.10.0 added debounce and throttle helpers to its standard library.InfoQ: “Debounce and throttle helpers have landed in node:util”
- SupportedNode.js 26.10.0 added a crypto API for parsing PKCS#12 certificates.InfoQ: “a new crypto.parsePKCS12() API now surfaces private keys and certificates from .p12 and .pfx bundles”
- SupportedThe additions continue a trend of richer standard libraries and reduce reliance on third-party packages.InfoQ: “Compared with Bun and Deno, both of which have tended to ship richer standard libraries by default, this run of additions continues a visible trend in Node.js of reducing reliance on userland utilities.”
- SupportedThe new rate-limiting helpers address functionality commonly obtained from packages such as lodash or throttle-debounce.InfoQ: “Rate-limiting helpers have long been one of the most commonly vendored dependencies in the Node.js ecosystem, typically pulled from lodash or the throttle-debounce package.”
- SupportedJames M Snell landed both debounce and throttle in one pull request.InfoQ: “James M Snell landed both in a single pull request”
- SupportedMatteo Collina said he uses the utilities in “essentially every app.”InfoQ: “with Matteo Collina noting that he uses these utilities in "essentially every app."”
- SupportedSnell changed the AbortSignal behavior to cancel every future invocation and added an option for the first call to fire immediately.InfoQ: “Snell reworked the signal to cancel every future invocation and added a leading-edge option so the first call can fire immediately.”
- Supportedutil.markPromiseAsHandled() gives framework authors a way to tell the runtime that a promise has been handled.InfoQ: “an explicit mechanism for framework authors to tell the runtime that a promise has been handled”
- Supportedcrypto.parsePKCS12() wraps OpenSSL’s d2i_PKCS12_bio() and PKCS12_parse(), returning privateKey, certificate and additionalCertificates fields.InfoQ: “The new API wraps OpenSSL's d2i_PKCS12_bio() and PKCS12_parse(), returning an object with privateKey, certificate, and additionalCertificates fields.”
- SupportedThe change was Brian Muenzenmeyer’s first significant core contribution touching C++, refined with Filip Skokan.InfoQ: “It was Brian Muenzenmeyer's first significant core contribution touching C++, refined with Filip Skokan”
- SupportedThe experimental Virtual File System was extended into node:ffi so libraries can load from a mounted VFS, using an anonymous memfd approach under Linux.InfoQ: “Matteo Collina and Philipp Dunkel extended node:ffi to load libraries straight from a mounted VFS, using the same self-cleaning anonymous memfd trick that native addons already rely on under Linux.”
- SupportedNode.js 26 is Active LTS under the codename “Lithium,” with support through April 2029.InfoQ: “Node.js 26 has now moved to Active LTS as "Lithium" with support through April 2029.”
