Node.js 26.8 brings native ZIP handling and SQLite resource management

Released on 26 August 2026, Node.js 26.8.0 is a minor version on the Current line. Behind an unassuming number, it moves into the standard library several jobs that were until now handed off to external packages: ZIP archive handling, deterministic cleanup of SQLite statements, and a non-throwing variant of the MIME parser.

#ZIP archives inside the zlib module

The zlib module only offered stream compression so far: gzip, deflate and brotli. It could not open or assemble a .zip file, the archive format most widely used for exports, themes, plugins and translation packs. That gap forced a dependency such as adm-zip, yauzl or jszip.

26.8 adds three classes to zlib: ZipEntry, ZipFile and ZipBuffer. A project can now read the contents of an archive and produce a new one without leaving the runtime core, which cuts down the surface to audit and maintain.

#Explicit resource management reaches SQLite

The node:sqlite module, stabilised over the course of the 24 series, gains two methods on StatementSync: close() and [Symbol.dispose](). The second wires the object to JavaScript’s using keyword, which releases the resource automatically when the block exits.

import { DatabaseSync } from 'node:sqlite';

const db = new DatabaseSync('app.db');

// `using` appelle Symbol.dispose a la sortie du bloc :
// le statement est ferme sans try/finally explicite.
{
  using stmt = db.prepare('SELECT email FROM users WHERE id = ?');
  const row = stmt.get(42);
  console.log(row.email);
}
// stmt.close() a deja ete appele ici.

The benefit is not cosmetic: a statement left open holds a lock and memory. Handing its cleanup to the language engine removes an entire class of leaks.

Every brick pulled back into the standard library is one fewer dependency to audit, update and patch under pressure.

#Crypto, MIME and REPL: the quieter additions

On the crypto side, the release enables the SIV and GCM-SIV modes in the Cipher and Decipher APIs, and lets you set the mgf1Hash hashing algorithm for RSA-OAEP. The util module receives a non-throwing version of MIMEType.parse: instead of raising an exception on an invalid value, it returns null.

import { MIMEType } from 'node:util';

// Ancienne voie : new MIMEType(valeur) leve sur une entree douteuse.
// 26.8 : parse renvoie null au lieu de jeter.
const type = MIMEType.parse(enTete);
if (type === null) {
  // entree rejetee proprement, sans try/catch
}

The interactive REPL finally gets basic syntax highlighting, and the TracingChannel API from diagnostics_channel moves to stable status. The certificate authority list is updated to NSS 3.126.

#What the release internalises

#Key takeaways

• Node.js 26.8.0 shipped on 26 August 2026 on the Current line, alongside 24.20.0 LTS.
• The zlib module can now read and write ZIP archives through ZipEntry, ZipFile and ZipBuffer.
• node:sqlite aligns with explicit resource management via using.
• The crypto and util additions and REPL highlighting round out a minor, non-breaking release.

#Going further

Full release notes: Node.js v26.8.0 (nodejs.org).

#Also on Mail Studio

• Node.js 26 enables the Temporal API by default
• Drupal in 2026: still a reasonable choice?