Node.js 25.x: What's New, Release History & Support Lifecycle

What Is New in Node.js 25?

V8 14.1 -- Uint8Array Base64/Hex and JSON Performance

V8 14.1 ships two headline JavaScript additions. First, Uint8Array gains native .toBase64(), .fromBase64(), .toHex(), and .fromHex() methods. This eliminates the need for the Buffer workaround or a base64 library for simple encoding tasks.

const data = new Uint8Array([72, 101, 108, 108, 111]);
const b64 = data.toBase64();   // 'SGVsbG8='
const hex = data.toHex();     // '48656c6c6f'

const back = Uint8Array.fromBase64('SGVsbG8=');
// [72, 101, 108, 108, 111]

Second, JSON.stringify receives a major performance improvement in V8 14.1. Benchmarks show significant speedups for objects with many string-valued properties. For applications that heavily serialize large objects to JSON (API responses, logging), this translates to measurable throughput gains with no code changes.

Network Permission Control with --allow-net

The Permission Model gains --allow-net, letting you restrict which hostnames or IP addresses a process can connect to. Combined with --allow-fs-read / --allow-fs-write, you can now lock down a Node.js process at both filesystem and network levels.

# Only allow connections to api.example.com on port 443
node --permission \
  --allow-fs-read=/app \
  --allow-net=api.example.com:443 \
  server.js

# Block all network access
node --permission --allow-fs-read=/data processor.js

This is useful for worker processes, serverless functions, and any sandboxed execution context where you want to prevent unexpected egress -- without modifying application code.

Web Storage Enabled by Default

The Web Storage API (localStorage and sessionStorage) is available in the global scope by default in Node.js 25, without any flag. The implementation is file-backed per the SQLite storage spec, keyed by the origin string.

In practice, this matters most for code portability -- Web components, browser-targeting libraries, and server-side rendering code can now access localStorage in Node.js without polyfills. For long-running servers, be aware the storage persists between restarts unless you explicitly clear it.

Corepack Removed from Node.js Distribution

Corepack is no longer shipped with Node.js 25. If you relied on Corepack to manage Yarn or pnpm versions, you now need to install it separately: npm install -g corepack. This follows Node.js's philosophy of keeping the core runtime lean, with package manager tooling as an opt-in.

The packageManager field in package.json still works when Corepack is installed globally -- the removal only affects whether it is pre-installed alongside Node.

WebAssembly JSPI -- JavaScript Promise Integration

JSPI (JavaScript Promise Integration for WebAssembly) allows WebAssembly modules to suspend execution while waiting for a JavaScript Promise to resolve, and resume once it does. This unlocks true async/await patterns inside WebAssembly without rewriting sync WASM to a callback model.

This is particularly significant for WASM-compiled applications (like Python or Ruby runtimes compiled to WASM) that call asynchronous browser/Node.js APIs -- they can now do so without manually restructuring their execution stacks.

Breaking Changes and Removals to Know About

Several long-deprecated items reach end-of-life in Node.js 25:

• fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK are removed -- use fs.constants.F_OK etc. instead
• assert.CallTracker is removed -- no direct built-in replacement; use a mocking library
• SlowBuffer is fully removed -- use Buffer.allocUnsafe()
• assert.fail(message, actual, expected) multi-argument form removed -- use assert.fail(message)
• The _stream_* internal modules (_stream_readable, etc.) are deprecated -- import from node:stream
• assert deep equality now correctly fails promise comparisons and handles invalid dates