Node.js can now revoke permissions at runtime and audit what it would block, so you can harden a production process without a restart.
Node.js 24.20.0 (Krypton LTS) lets a live process revoke its own permissions now. permission.drop does it mid-flight, so a server can hand back file, network, and child-process access the moment the request that needed them finishes. No restart, no redeploy, and no privilege window that outlives the work.
Pair that with --permission-audit and you get enforcement you can actually adopt. The flag logs denied access attempts instead of throwing, so you can watch what your app reaches for before hard denial is on. No crash, no surprise outage, just a clear record of what enforcement will block. That is what makes the Permission Model safe to run in production.
The rest of the release is background noise. The module loader implements package maps, a contribution from the Yarn PnP author. WebAssembly JSPI is on. node:stream/iter and AsyncLocalStorage-with-scopes APIs are new. npm 11.19.0 rides along. Look at those if you touch WASM or streams; the permission work is the story.
Try --permission-audit on a staging box this week. The output tells you exactly which privileges your app actually uses, and permission.drop lets you shed the ones it does not.
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
A coordinated campaign injected malicious code into 14 widely-used npm packages last week. We break down the affected packages, detection steps for your lockfile, and the one CI flag that catches this.
1 source
Researchers ran a full remote Spectre attack against a co-located Worker in production, and the 360x speedup over 2021 makes serverless co-tenanting look far less safe.
1 source