Node.js 26.9.0 turns on native FFI by default, no security fixes listed

Node.js 26.9.0 shipped on September 16 as a Current feature release, and the change log lists no security fixes. That absence matters less than what got turned on. The release enables ffi by default, adds a generic MAC API, introduces OpenSSL provider discovery, and ships node:bench alongside experimental DTLS support and VFS integration spanning CommonJS and ESM module loading. Current releases are not LTS. Teams running production pipelines on the LTS line will not see these changes land yet, but they define what is coming once the next even-numbered line promotes.

For anyone moving data between systems, ffi enabled by default is the item to flag first. Foreign function interface access lets JavaScript call directly into native libraries without a compiled addon step. That speeds up prototyping connectors to legacy C libraries, but it also means any dependency can reach outside the V8 sandbox by default rather than by explicit opt-in. Audit tooling that scans for native bindings needs to treat ffi calls as a new surface, not an edge case. Nothing in the release notes says whether ffi can be disabled per-process or only at build time, which is the first thing to check before this version touches a data path with untrusted input.

The OpenSSL provider discovery change affects anyone who terminates TLS or verifies signatures inside a pipeline. Provider discovery changes how Node.js locates cryptographic backends at runtime, which matters for shops pinning specific FIPS-validated or hardware-backed OpenSSL providers for compliance reasons. If discovery now walks a different search path or prioritizes providers differently, a system that quietly depended on load order could start picking a different provider on next restart. The release notes do not specify the discovery algorithm or whether existing provider configuration files remain compatible without edits. That is worth a controlled test before any upgrade touches a regulated workload.

VFS integration across CJS and ESM is the quieter but longer-term item. Module resolution has been a recurring seam for tools that move data between formats, especially ETL scripts that mix require and import across a codebase. Tighter integration at the virtual file system layer could reduce the duplicate-module problem that shows up when a package gets loaded twice under two different module systems, which has broken deduplication and caused subtle state bugs in long-running data jobs. Whether this closes that gap fully or only narrows it is not detailed in the announcement. node:bench, a new built-in for benchmarking, gives teams a standard way to measure before and after that change.

Web Workers and experimental DTLS round out the list, and both touch interoperability more than correctness. DTLS support opens the door to UDP-based encrypted transport for telemetry and streaming use cases that previously needed a third-party library. It is marked experimental, so pinning to it for anything beyond a proof of concept is premature. None of these six items came with security advisories attached. Release 26.9.0 is current, not long-term, and the eventual LTS promotion date is the one still missing from the record.