Node.js 24.22.0 Adds Native Crypto APIs, Throttle/Debounce and a Closable StatementSync

The Node.js “Krypton” LTS line received version 24.22.0 on October 14, 2026, bundling seventeen notable changes. The batch touches the crypto module, the built-in SQLite API, perf_hooks and the util module, headlined by two functions teams have been reimplementing for years: util.throttle and util.debounce.

#Crypto gains new certificate and cipher-mode support

Five of the seventeen changes land in cryptography. crypto.parsePKCS12() now reads a PKCS#12 container (the .p12/.pfx format used to bundle a certificate and its private key) directly, without a third-party dependency. A generic MAC API was also added, alongside dynamic discovery of ciphers and hash functions exposed by OpenSSL providers. SIV and GCM-SIV modes finally join the Cipher and Decipher APIs — two modes resistant to accidental nonce reuse, a scenario that has already burned more than one application-level encryption scheme.

#util.throttle and util.debounce leave the realm of third-party libraries

Until now, rate-limiting a function call (debounce) or capping its execution rate (throttle) meant installing lodash or a small dedicated package. Node.js 24.22.0 ships a native implementation of both in node:util, built for server scripts that need to slow down disk writes, outbound API calls, or repeated notifications.

import { throttle, debounce } from 'node:util';

const logMetrics = throttle(() => {
  console.log('metrics snapshot sent');
}, 5000);

const persistDraft = debounce((content) => {
  writeFileSync('draft.json', JSON.stringify(content));
}, 800);

onMetricTick(logMetrics);
onEditorChange(persistDraft);

#SQLite: prepared statements can now be closed explicitly

StatementSync.prototype.close() and StatementSync.prototype[Symbol.dispose]() land in the node:sqlite module. Prepared statements used to stay open for as long as the process ran; they can now be released explicitly, or automatically via the language’s using syntax, simplifying resource handling in migration scripts and one-off tasks.

#perf_hooks sharpens latency observability

The performance measurement module gets a new sliding-window histogram, SlidingWindowHistogram, plus a mean confidence-interval API (meanCI) and CBOR export/import so histograms can travel between processes or services.

With SlidingWindowHistogram, perf_hooks no longer settles for one rolling average: it captures how a latency evolves over time, not just its mean across the process’s whole lifetime.

This point release illustrates a long-running trend on the 24 branch: pulling into the runtime’s core the utilities most teams used to fetch from npm. It is the same movement behind enabling the Temporal API by default in Node.js 26, where the project chose to standardize rather than let the ecosystem fragment the same need across dozens of competing packages.

#Key takeaways

Node.js 24.22.0 remains a minor update in the strict sense (SEMVER-MINOR on nearly every change), with no breaking change expected for existing applications. Teams handling client certificates, writing rate-limiting scripts, or relying on embedded SQLite now have a concrete reason to schedule the move to this LTS line.

Further reading: the full list of changes for version 24.22.0 is available in the official Node.js 24 changelog.