Node.js 26.5.0 without the rush: testing text imports, the event loop, and TLS

When a release link is not yet an upgrade plan

A link to Node.js 26.5.0 appears in the team chat. The first useful question is not “How do we upgrade?” but “Is anything here relevant to our service?” The release, published on July 8, 2026, belongs to the Current release line. That makes it a good laboratory target, not an automatic replacement for a production LTS.

Instead of reviewing the entire changelog, we will inspect three signals: text import, two event-loop delay measurement modes, and the result of getEphemeralKeyInfo() for TLS groups. The goal is to produce reproducible notes without touching production.

Conditions for a safe experiment

Install Node.js 26.5.0 with a version manager or in a separate container. Do not replace the system runtime or alter the service image. Record the following at the top of the laboratory log:

node --version
node -p "process.platform + ' ' + process.arch"
node -p "process.versions.openssl"

The first command should return v26.5.0. Use a separate directory with no production configuration. For a fair comparison, run the same scenario on the same machine without unrelated heavy workloads.

Entry 1: A text file as a module

Create message.txt with several lines, non-ASCII characters, and an empty line. Add import-text.mjs beside it:

import message from './message.txt' with { type: 'text' };

console.log(JSON.stringify(message));

Run the experiment:

node --experimental-import-text import-text.mjs

Check whether line breaks and characters are preserved, then repeat the command without the flag. Text import is experimental in this release, so the flag is an important part of its contract. Test the runner, bundler, and static analysis tools separately. Support in Node.js does not guarantee support across the entire toolchain.

An anti-pattern is immediately using this capability to build a production configuration loader. A small internal tool or a test fixture is a safer first candidate.

Entry 2: Two views of event-loop delay

monitorEventLoopDelay() already produced a histogram of delays. Node.js 26.5.0 lets you explicitly enable samplePerIteration: true to take a sample for each event-loop iteration. The existing behavior remains unchanged when this option is absent.

import { monitorEventLoopDelay, performance } from 'node:perf_hooks';

const perIteration = process.argv.includes('--per-iteration');
const options = perIteration
  ? { samplePerIteration: true }
  : { resolution: 10 };

const histogram = monitorEventLoopDelay(options);
histogram.enable();

const blocker = setInterval(() => {
  const until = performance.now() + 35;
  while (performance.now() < until) {}
}, 200);

setTimeout(() => {
  clearInterval(blocker);
  histogram.disable();
  console.log({
    mode: perIteration ? 'per-iteration' : 'interval',
    p50ms: histogram.percentile(50) / 1e6,
    p99ms: histogram.percentile(99) / 1e6,
    maxMs: histogram.max / 1e6
  });
}, 3000);

Run the modes separately:

node delay.mjs
node delay.mjs --per-iteration

Do not compare the two modes’ numeric values directly: they use different sampling strategies and are expected to produce different distributions. For each mode separately, record the 50th and 99th percentile, consistency across repeated runs, and CPU cost, then decide which signal fits your observability goal. This is not a universal performance benchmark. Do not run both histograms at the same time, because measurement itself may influence the result.

Entry 3: What the TLS connection reports

In a controlled test, a client TLSSocket can expose information about key agreement. In Node.js 26.5.0, getEphemeralKeyInfo() can also return a type of TLSGroup when OpenSSL does not provide the usual temporary key object for the negotiated group-based scheme. This includes newer post-quantum and hybrid options when the peers actually negotiate them.

import tls from 'node:tls';

const host = process.env.TLS_HOST;
if (!host) throw new Error('Set TLS_HOST');

const socket = tls.connect({
  host,
  port: Number(process.env.TLS_PORT || 443),
  servername: host,
  minVersion: 'TLSv1.3'
}, () => {
  console.log(socket.getProtocol());
  console.log(socket.getEphemeralKeyInfo());
  socket.end();
});

socket.on('error', console.error);

The result depends on the client, server, OpenSSL build, and the TLS group that was actually negotiated. The absence of TLSGroup does not prove that a problem exists. Likewise, one group name is not a complete security-policy check. Start by using this data for diagnostics and logging.

The decision after the laboratory session

• Observe: the change is irrelevant to the service, the toolchain does not support it, or the result provides no practical benefit.
• Test: there is a specific use case, a repeatable benefit, and a way to add the check to CI without changing the production environment.
• Adopt: dependency compatibility is confirmed, load tests pass, team policy permits the version, and rollback has been tested.

Three short experiments do not turn a Current release into an LTS. They do something more useful: replace a general impression with a measurable decision for a specific service.

Sources

• Node.js 26.5.0 release
• Experimental text import
• Event-loop delay sampling per iteration
• Negotiated TLS groups