Node.js 26.9.0 landed on September 16, 2026, as a Current feature release, not an LTS build. The release notes list a generic MAC API, OpenSSL provider discovery, node:bench, experimental DTLS support, VFS integration across CommonJS and ESM, Web Workers additions, and ffi enabled by default. The opened notes list no security fixes for this build. That last point matters as much as any new API. For teams tracking Node releases by severity, a release with zero listed CVEs usually drops down the patch queue, scheduled in behind anything that touches TLS, dependency chains, or auth paths.
Most production fleets run LTS, not Current, so 26.9.0 will not touch many deployed services directly. But Current releases preview what eventually lands in the next LTS line, and ffi moving to enabled-by-default is the kind of change that deserves a second look now rather than after it ships somewhere stable. Node's own announcement does not say which LTS version will inherit this default, or whether the ffi behavior will ship opt-out, opt-in, or unconditional by the time it reaches a long-term branch. That gap is worth tracking before the next LTS cut, not after.
Foreign function interface access changes the threat model for any process that loads untrusted modules or runs multi-tenant workloads. An ffi path that is on by default means native code execution becomes reachable through a dependency tree that previously required explicit configuration to touch. On-call engineers should check whether any service in their stack pins to Current rather than LTS, since that is the only place 26.9.0 applies today. Worth a scan: container base images, build pipelines, and any Dockerfile that references node:current instead of a numbered LTS tag.
The DTLS support is marked experimental, which is Node's own signal that the API can change or break between releases without a deprecation cycle. Anyone wiring up experimental DTLS into a service should treat it as throwaway code until it graduates, not as a foundation. The VFS changes affecting CommonJS and ESM module resolution are a quieter risk: module loading bugs tend to surface as intermittent failures tied to specific import patterns, which are hard to triage under on-call pressure because they rarely reproduce cleanly in a staging environment built from different source layouts.
Security teams should resist reading 'no security fixes' as 'no action needed.' The absence of listed CVEs in 26.9.0 says nothing about outstanding issues in the LTS lines most production systems actually run; it only describes this specific feature release. A six-word fact worth pinning to a runbook: Current builds skip the LTS validation cycle. Platform operators maintaining CI matrices that test against Current should flag the ffi default change in their test suite now, before a dependency update silently starts exercising that code path in a build nobody flagged for review.