diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 69a4d6613b9b..b3adac992f46 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1777,6 +1777,11 @@ console.log(snapshot.percentile(99));
 
 <!-- YAML
 added: v26.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/66098
+    description: Format version 2 is supported. Unknown keys in version 2
+                 data are ignored.
 -->
 
 * `data` {Uint8Array} A CBOR-encoded histogram previously produced by
@@ -1787,6 +1792,9 @@ Reconstructs a histogram from a CBOR-encoded `Uint8Array`. The returned
 histogram is a full {RecordableHistogram} with all bucket data, configuration,
 and EWMA state restored. New values can be recorded into it.
 
+Data in any format version produced by [`histogram.export()`][] can be
+imported. See [histogram export format compatibility][] for details.
+
 ```js
 const { createHistogram, importHistogram } = require('node:perf_hooks');
 
@@ -2180,6 +2188,10 @@ loop delay threshold.
 
 <!-- YAML
 added: v26.9.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/66098
+    description: The output uses format version 2.
 -->
 
 * Returns: {Uint8Array}
@@ -2198,7 +2210,7 @@ The CBOR payload is a map with integer keys:
 
 | Key | Type    | Field                                         |
 | --- | ------- | --------------------------------------------- |
-| 0   | uint    | Format version (currently 1)                  |
+| 0   | uint    | Format version (currently 2)                  |
 | 1   | uint    | Lowest discernible value                      |
 | 2   | uint    | Highest trackable value                       |
 | 3   | uint    | Significant figures                           |
@@ -2213,6 +2225,23 @@ The CBOR payload is a map with integer keys:
 
 Any standard CBOR decoder can parse the output.
 
+#### Histogram export format compatibility
+
+[`perf_hooks.importHistogram()`][] accepts every format version that
+`histogram.export()` has produced:
+
+* Version 1 was produced by Node.js v26.9.0. Data with a version 1 key, or
+  without a version key, is imported with the original semantics: keys
+  that are not listed above are rejected.
+* Version 2 has the same layout as version 1. Keys that are not recognized
+  are ignored, so later versions of Node.js can add fields to version 2
+  data without changing the version, and the data remains importable.
+
+Data with any other version is rejected.
+
+When the total count, min, or max value is absent, it is derived from the
+bucket counts. A total count that is present must match the bucket counts.
+
 ### `histogram.ewmaMean`
 
 <!-- YAML
@@ -3267,3 +3296,4 @@ dns.promises.resolve('localhost');
 [`timeOrigin`]: https://w3c.github.io/hr-time/#dom-performance-timeorigin
 [`window.performance.toJSON`]: https://developer.mozilla.org/en-US/docs/Web/API/Performance/toJSON
 [`window.performance`]: https://developer.mozilla.org/en-US/docs/Web/API/Window/performance
+[histogram export format compatibility]: #histogram-export-format-compatibility
diff --git a/src/histogram.cc b/src/histogram.cc
index 63f297936773..1b9560bea95e 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -1066,18 +1066,109 @@ static bool CborReadFloat64(const uint8_t*& p,
   return true;
 }
 
+// Read the argument of a data item that must have the given major type
+// (kCborUint, kCborArray, or kCborMap). CborReadUint() alone decodes the
+// argument of any major type.
+static bool CborReadArgument(const uint8_t*& p,
+                             const uint8_t* end,
+                             uint8_t major,
+                             uint64_t* val) {
+  if (p >= end || (*p & 0xe0) != major) return false;
+  return CborReadUint(p, end, val);
+}
+
+// Read an unsigned integer that must fit into a non-negative int64_t.
+static bool CborReadInt64(const uint8_t*& p, const uint8_t* end, int64_t* val) {
+  uint64_t v;
+  if (!CborReadArgument(p, end, kCborUint, &v) ||
+      v > static_cast<uint64_t>(std::numeric_limits<int64_t>::max())) {
+    return false;
+  }
+  *val = static_cast<int64_t>(v);
+  return true;
+}
+
+// Read an unsigned integer that must fit into a non-negative int32_t.
+static bool CborReadInt32(const uint8_t*& p, const uint8_t* end, int32_t* val) {
+  uint64_t v;
+  if (!CborReadArgument(p, end, kCborUint, &v) ||
+      v > static_cast<uint64_t>(std::numeric_limits<int32_t>::max())) {
+    return false;
+  }
+  *val = static_cast<int32_t>(v);
+  return true;
+}
+
 // Read a value that may be either a uint or float64.
 static bool CborReadNumber(const uint8_t*& p, const uint8_t* end, double* val) {
   if (p >= end) return false;
   if (*p == kCborFloat64) return CborReadFloat64(p, end, val);
   uint64_t u;
-  if (!CborReadUint(p, end, &u)) return false;
+  if (!CborReadArgument(p, end, kCborUint, &u)) return false;
   *val = static_cast<double>(u);
   return true;
 }
 
-// Histogram export format version.
-constexpr uint64_t kExportVersion = 1;
+// Maximum nesting depth of the values that CborSkipItem() skips over.
+constexpr int kCborMaxSkipDepth = 16;
+
+// Skip over one well-formed data item, including any items nested within it.
+// Indefinite-length items are not supported.
+static bool CborSkipItem(const uint8_t*& p, const uint8_t* end, int depth = 0) {
+  if (p >= end || depth > kCborMaxSkipDepth) return false;
+  const uint8_t major = *p >> 5;
+  const uint8_t info = *p & 0x1f;
+
+  if (major == 7) {
+    // Simple values and floats. Additional information 24 to 27 is followed
+    // by 1, 2, 4, or 8 bytes; 28 to 30 are reserved, and 31 is a break.
+    size_t extra;
+    if (info <= 23) {
+      extra = 0;
+    } else if (info <= 27) {
+      extra = size_t{1} << (info - 24);
+    } else {
+      return false;
+    }
+    p++;
+    if (static_cast<size_t>(end - p) < extra) return false;
+    p += extra;
+    return true;
+  }
+
+  uint64_t arg;
+  if (!CborReadUint(p, end, &arg)) return false;
+  switch (major) {
+    case 0:  // Unsigned integer.
+    case 1:  // Negative integer.
+      return true;
+    case 2:  // Byte string.
+    case 3:  // Text string.
+      if (arg > static_cast<uint64_t>(end - p)) return false;
+      p += arg;
+      return true;
+    case 4:    // Array.
+    case 5: {  // Map.
+      // Each item takes at least one byte, which also bounds the loop.
+      if (arg > static_cast<uint64_t>(end - p)) return false;
+      const uint64_t items = major == 4 ? arg : arg * 2;
+      for (uint64_t i = 0; i < items; i++) {
+        if (!CborSkipItem(p, end, depth + 1)) return false;
+      }
+      return true;
+    }
+    case 6:  // Tag.
+      return CborSkipItem(p, end, depth + 1);
+  }
+  return false;
+}
+
+// Histogram export format version. Version 2 has the same layout as
+// version 1, but importers ignore unknown keys in version 2 data, so fields
+// can be added without changing the version. Version 1 data is imported
+// with its original semantics, which reject unknown keys.
+constexpr uint64_t kExportVersion = 2;
+constexpr uint64_t kStrictExportVersion = 1;
 
 // Integer keys for the top-level CBOR map.
 constexpr uint64_t kKeyVersion = 0;
@@ -1390,7 +1481,7 @@ Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
 // common case.
 //
 // Layout: a CBOR map with integer keys:
-//   0  -> uint    format version (currently 1)
+//   0  -> uint    format version (currently 2)
 //   1  -> uint    lowest discernible value
 //   2  -> uint    highest trackable value
 //   3  -> uint    significant figures
@@ -1408,6 +1499,13 @@ Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
 //        2 -> float64 variance
 //        3 -> float64 error rate
 //        4 -> uint    threshold
+//
+// Compatibility: Import() accepts format versions 1 and 2, whose layouts are
+// identical. In version 2 data, keys that the importer does not recognize are
+// skipped, so new fields can be added without changing the version. Version 1
+// data keeps its original semantics, in which unknown keys are rejected. Any
+// field may be absent; the total count, min, and max are then derived from
+// the counts.
 std::vector<uint8_t> Histogram::Export() const {
   RwLock::ScopedReadLock lock(mutex_);
 
@@ -1502,20 +1600,37 @@ std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
   const uint8_t* end = data + len;
 
   // Read top-level map header.
-  if (p >= end || (*p >> 5) != 5) return nullptr;  // Must be a map.
   uint64_t map_size;
-  if (!CborReadUint(p, end, &map_size)) return nullptr;
+  if (!CborReadArgument(p, end, kCborMap, &map_size)) return nullptr;
 
   int64_t lowest = 1;
   int64_t highest = std::numeric_limits<int64_t>::max();
-  int figures = 3;
+  int32_t figures = 3;
   int64_t total_count = 0;
   int64_t min_value = std::numeric_limits<int64_t>::max();
   int64_t max_value = 0;
   int32_t norm_offset = 0;
   double conv_ratio = 1.0;
   int32_t counts_len = 0;
-  uint64_t version = 0;
+  // Data without a version key is imported as version 1.
+  uint64_t version = kStrictExportVersion;
+
+  // Bitsets of the keys read so far, used to reject duplicate keys and to
+  // tell whether a field was present. All known keys are less than 64.
+  uint64_t seen_keys = 0;
+  uint64_t seen_ewma_keys = 0;
+  // Unknown keys are skipped while parsing, because the version key that
+  // determines whether they are allowed can appear anywhere in the map.
+  bool has_unknown_keys = false;
+  auto mark_seen = [](uint64_t* seen, uint64_t key) {
+    const uint64_t bit = uint64_t{1} << key;
+    if (*seen & bit) return false;
+    *seen |= bit;
+    return true;
+  };
+  auto has_key = [&seen_keys](uint64_t key) {
+    return (seen_keys & (uint64_t{1} << key)) != 0;
+  };
 
   // Sparse counts storage.
   std::vector<std::pair<int32_t, int64_t>> sparse_counts;
@@ -1530,74 +1645,56 @@ std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
   for (uint64_t i = 0; i < map_size; i++) {
     // Read key (unsigned int).
     uint64_t key;
-    if (!CborReadUint(p, end, &key)) return nullptr;
+    if (!CborReadArgument(p, end, kCborUint, &key)) return nullptr;
+    if (key > kKeyEwma) {
+      // Unknown key.
+      if (!CborSkipItem(p, end)) return nullptr;
+      has_unknown_keys = true;
+      continue;
+    }
+    if (!mark_seen(&seen_keys, key)) return nullptr;  // Duplicate key.
 
     switch (key) {
       case kKeyVersion:
-        if (!CborReadUint(p, end, &version)) return nullptr;
-        if (version != kExportVersion) return nullptr;
+        if (!CborReadArgument(p, end, kCborUint, &version)) return nullptr;
+        if (version < kStrictExportVersion || version > kExportVersion) {
+          return nullptr;
+        }
         break;
-      case kKeyLowest: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        lowest = static_cast<int64_t>(v);
+      case kKeyLowest:
+        if (!CborReadInt64(p, end, &lowest)) return nullptr;
         break;
-      }
-      case kKeyHighest: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        highest = static_cast<int64_t>(v);
+      case kKeyHighest:
+        if (!CborReadInt64(p, end, &highest)) return nullptr;
         break;
-      }
-      case kKeyFigures: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        figures = static_cast<int>(v);
+      case kKeyFigures:
+        if (!CborReadInt32(p, end, &figures)) return nullptr;
         break;
-      }
-      case kKeyTotalCount: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        total_count = static_cast<int64_t>(v);
+      case kKeyTotalCount:
+        if (!CborReadInt64(p, end, &total_count)) return nullptr;
         break;
-      }
-      case kKeyMin: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        min_value = static_cast<int64_t>(v);
+      case kKeyMin:
+        if (!CborReadInt64(p, end, &min_value)) return nullptr;
         break;
-      }
-      case kKeyMax: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        max_value = static_cast<int64_t>(v);
+      case kKeyMax:
+        if (!CborReadInt64(p, end, &max_value)) return nullptr;
         break;
-      }
-      case kKeyNormOffset: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        // Reject values that cannot be represented as int32_t; the
-        // static_cast below would wrap and produce an arbitrary offset.
-        if (v > static_cast<uint64_t>(std::numeric_limits<int32_t>::max()))
-          return nullptr;
-        norm_offset = static_cast<int32_t>(v);
+      case kKeyNormOffset:
+        // Reject values that cannot be represented as int32_t; casting them
+        // would wrap and produce an arbitrary offset.
+        if (!CborReadInt32(p, end, &norm_offset)) return nullptr;
         break;
-      }
       case kKeyConvRatio:
         if (!CborReadNumber(p, end, &conv_ratio)) return nullptr;
         break;
-      case kKeyCountsLen: {
-        uint64_t v;
-        if (!CborReadUint(p, end, &v)) return nullptr;
-        counts_len = static_cast<int32_t>(v);
+      case kKeyCountsLen:
+        if (!CborReadInt32(p, end, &counts_len)) return nullptr;
         break;
-      }
       case kKeyCounts: {
         // Array of flat [delta, count, ...] pairs. Indices are
         // delta-encoded: accumulate to recover absolute indices.
-        if (p >= end || (*p >> 5) != 4) return nullptr;
         uint64_t arr_len;
-        if (!CborReadUint(p, end, &arr_len)) return nullptr;
+        if (!CborReadArgument(p, end, kCborArray, &arr_len)) return nullptr;
         if (arr_len % 2 != 0) return nullptr;
         // Each element needs at least 1 byte of CBOR encoding, so
         // arr_len can't exceed the remaining buffer. Without this
@@ -1605,24 +1702,35 @@ std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
         // reserve() to OOM-crash before the loop catches the error.
         if (arr_len > static_cast<uint64_t>(end - p)) return nullptr;
         sparse_counts.reserve(static_cast<size_t>(arr_len / 2));
-        int32_t acc_idx = 0;
+        int64_t acc_idx = 0;
         for (uint64_t j = 0; j < arr_len; j += 2) {
-          uint64_t delta, cnt;
-          if (!CborReadUint(p, end, &delta)) return nullptr;
-          if (!CborReadUint(p, end, &cnt)) return nullptr;
-          acc_idx += static_cast<int32_t>(delta);
-          sparse_counts.emplace_back(acc_idx, static_cast<int64_t>(cnt));
+          int32_t delta;
+          int64_t cnt;
+          if (!CborReadInt32(p, end, &delta)) return nullptr;
+          if (!CborReadInt64(p, end, &cnt)) return nullptr;
+          // Indices are strictly increasing, so only the first delta (the
+          // absolute index of the first non-empty bucket) may be zero.
+          if (j > 0 && delta == 0) return nullptr;
+          acc_idx += delta;
+          if (acc_idx > std::numeric_limits<int32_t>::max()) return nullptr;
+          sparse_counts.emplace_back(static_cast<int32_t>(acc_idx), cnt);
         }
         break;
       }
       case kKeyEwma: {
         // Sub-map for EWMA state.
-        if (p >= end || (*p >> 5) != 5) return nullptr;
         uint64_t sub_size;
-        if (!CborReadUint(p, end, &sub_size)) return nullptr;
+        if (!CborReadArgument(p, end, kCborMap, &sub_size)) return nullptr;
         for (uint64_t j = 0; j < sub_size; j++) {
           uint64_t sub_key;
-          if (!CborReadUint(p, end, &sub_key)) return nullptr;
+          if (!CborReadArgument(p, end, kCborUint, &sub_key)) return nullptr;
+          if (sub_key > kEwmaThreshold) {
+            // Unknown EWMA key.
+            if (!CborSkipItem(p, end)) return nullptr;
+            has_unknown_keys = true;
+            continue;
+          }
+          if (!mark_seen(&seen_ewma_keys, sub_key)) return nullptr;
           switch (sub_key) {
             case kEwmaAlpha:
               if (!CborReadNumber(p, end, &ewma_alpha)) return nullptr;
@@ -1636,23 +1744,19 @@ std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
             case kEwmaErrorRate:
               if (!CborReadNumber(p, end, &ewma_error_rate)) return nullptr;
               break;
-            case kEwmaThreshold: {
-              uint64_t v;
-              if (!CborReadUint(p, end, &v)) return nullptr;
-              threshold = static_cast<int64_t>(v);
+            case kEwmaThreshold:
+              if (!CborReadInt64(p, end, &threshold)) return nullptr;
               break;
-            }
-            default:
-              return nullptr;  // Unknown EWMA key.
           }
         }
         break;
       }
-      default:
-        return nullptr;  // Unknown key.
     }
   }
 
+  // Version 1 data keeps its original semantics: unknown keys are rejected.
+  if (version == kStrictExportVersion && has_unknown_keys) return nullptr;
+
   // Reconstruct the histogram.
   Options opts;
   opts.lowest = lowest;
@@ -1679,16 +1783,31 @@ std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
   if (norm_offset < 0 || norm_offset >= counts_len) return nullptr;
 
   // Restore counts directly.
+  int64_t observed_total_count = 0;
   for (const auto& [idx, cnt] : sparse_counts) {
     if (idx < 0 || idx >= counts_len) return nullptr;
+    // The counts must add up without overflowing int64_t.
+    if (cnt > std::numeric_limits<int64_t>::max() - observed_total_count) {
+      return nullptr;
+    }
+    observed_total_count += cnt;
     histogram->histogram_->counts[idx] = cnt;
   }
-  histogram->histogram_->total_count = total_count;
-  histogram->histogram_->min_value = min_value;
-  histogram->histogram_->max_value = max_value;
   histogram->histogram_->normalizing_index_offset = norm_offset;
   histogram->histogram_->conversion_ratio = conv_ratio;
 
+  // Derive the total count, min, and max from the counts, as
+  // Histogram::Subtract() does. This keeps the histogram consistent when
+  // any of them are absent. A total count that is present must match the
+  // counts. Min and max values that are present are restored as recorded.
+  hdr_reset_internal_counters(histogram->histogram_.get());
+  if (has_key(kKeyTotalCount) &&
+      total_count != histogram->histogram_->total_count) {
+    return nullptr;
+  }
+  if (has_key(kKeyMin)) histogram->histogram_->min_value = min_value;
+  if (has_key(kKeyMax)) histogram->histogram_->max_value = max_value;
+
   // Restore EWMA state.
   if (ewma_alpha > 0) {
     histogram->ewma_mean_ = ewma_mean;
diff --git a/test/parallel/test-perf-hooks-histogram-import.js b/test/parallel/test-perf-hooks-histogram-import.js
new file mode 100644
index 000000000000..c5d7f75c6929
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-import.js
@@ -0,0 +1,285 @@
+'use strict';
+
+// Tests validation of the CBOR payload accepted by importHistogram().
+
+require('../common');
+const assert = require('node:assert');
+const { createHistogram, importHistogram } = require('node:perf_hooks');
+
+// Minimal CBOR (RFC 8949) encoding helpers for building payloads. Each
+// helper returns an array of bytes.
+function head(major, value) {
+  const v = BigInt(value);
+  const m = major << 5;
+  if (v < 24n) return [m | Number(v)];
+  const bytes = [];
+  const width = v < 0x100n ? 1 : v < 0x10000n ? 2 : v < 0x100000000n ? 4 : 8;
+  for (let i = width - 1; i >= 0; i--) {
+    bytes.push(Number((v >> BigInt(i * 8)) & 0xffn));
+  }
+  return [m | { 1: 24, 2: 25, 4: 26, 8: 27 }[width], ...bytes];
+}
+const uint = (value) => head(0, value);
+const negint = (value) => head(1, value);  // Encodes -1 - value.
+const text = (str) => [...head(3, Buffer.byteLength(str)), ...Buffer.from(str)];
+function f64(value) {
+  const buf = Buffer.alloc(9);
+  buf[0] = 0xfb;
+  buf.writeDoubleBE(value, 1);
+  return [...buf];
+}
+
+function array(items) {
+  const out = head(4, items.length);
+  for (const item of items) out.push(...item);
+  return out;
+}
+
+function map(entries) {
+  const out = head(5, entries.length);
+  for (const { 0: key, 1: value } of entries) out.push(...key, ...value);
+  return out;
+}
+const importBytes = (bytes) => importHistogram(new Uint8Array(bytes));
+const kInvalid = { code: 'ERR_INVALID_ARG_VALUE' };
+
+// lowest=1 (the default), highest=100, figures=1 produces counts_len=64, with
+// indexes below 32 mapping to the identical values.
+const kLayout = [
+  [uint(2), uint(100)],  // highest
+  [uint(3), uint(1)],    // figures
+  [uint(9), uint(64)],   // counts length
+];
+const counts = (...pairs) => [uint(10), array(pairs.map((v) => uint(v)))];
+
+{
+  // Absent total count, min, and max are derived from the counts.
+  const h = importBytes(map([...kLayout, counts(5, 2, 3, 1)]));
+  assert.strictEqual(h.count, 3);
+  assert.strictEqual(h.min, 5);
+  assert.strictEqual(h.max, 8);
+  assert.strictEqual(h.percentile(50), 5);
+  assert.strictEqual(h.percentile(100), 8);
+}
+
+{
+  // A total count that is present must match the counts.
+  const h = importBytes(map([...kLayout, [uint(4), uint(3)], counts(5, 2, 3, 1)]));
+  assert.strictEqual(h.count, 3);
+  assert.throws(
+    () => importBytes(map([...kLayout, [uint(4), uint(4)], counts(5, 2, 3, 1)])),
+    kInvalid);
+  assert.throws(
+    () => importBytes(map([...kLayout, [uint(4), uint(1)]])),
+    kInvalid);
+}
+
+{
+  // Min and max values that are present are restored as recorded.
+  const h = createHistogram();
+  h.record(987654321);
+  h.record(1234567891);
+  const h2 = importHistogram(h.export());
+  assert.strictEqual(h2.min, h.min);
+  assert.strictEqual(h2.max, h.max);
+}
+
+// Duplicate keys are rejected.
+assert.throws(() => importBytes(map([...kLayout, [uint(3), uint(1)]])),
+              kInvalid);
+assert.throws(
+  () => importBytes(map([...kLayout, counts(5, 2), counts(6, 7)])),
+  kInvalid);
+assert.throws(() => importBytes(map([
+  ...kLayout,
+  [uint(11), map([[uint(0), f64(0.5)], [uint(0), f64(0.5)]])],
+])), kInvalid);
+
+// Keys must be unsigned integers.
+assert.throws(() => importBytes(map([...kLayout, [text('a'), uint(1)]])),
+              kInvalid);
+assert.throws(() => importBytes(map([...kLayout, [negint(0), uint(1)]])),
+              kInvalid);
+
+// Values must have the expected CBOR types.
+assert.throws(() => importBytes(map([
+  [uint(2), uint(100)], [uint(3), text('1')], [uint(9), uint(64)],
+])), kInvalid);
+assert.throws(() => importBytes(map([
+  [uint(2), negint(99)], [uint(3), uint(1)], [uint(9), uint(64)],
+])), kInvalid);
+assert.throws(() => importBytes(map([...kLayout, [uint(10), map([])]])),
+              kInvalid);
+assert.throws(() => importBytes(map([...kLayout, [uint(11), array([])]])),
+              kInvalid);
+
+// Values must not be truncated when casting to the field's type.
+assert.throws(() => importBytes(map([
+  [uint(2), uint(100)], [uint(3), uint(1)], [uint(9), uint(2n ** 32n + 64n)],
+])), kInvalid);
+assert.throws(() => importBytes(map([
+  [uint(2), uint(100)], [uint(3), uint(2n ** 32n + 1n)], [uint(9), uint(64)],
+])), kInvalid);
+assert.throws(() => importBytes(map([...kLayout, counts(5, 2n ** 63n)])),
+              kInvalid);
+assert.throws(() => importBytes(map([...kLayout, counts(2n ** 31n, 1)])),
+              kInvalid);
+
+// Counts must not overflow when added up.
+assert.throws(() => importBytes(map([
+  ...kLayout,
+  counts(1, 2n ** 62n, 1, 2n ** 62n, 1, 2n ** 62n),
+])), kInvalid);
+
+{
+  // Sparse count indexes must be strictly increasing. Only the first delta,
+  // which is an absolute index, may be zero.
+  const h = importBytes(map([...kLayout, counts(0, 1, 5, 1)]));
+  assert.strictEqual(h.count, 2);
+  assert.throws(() => importBytes(map([...kLayout, counts(5, 2, 0, 1)])),
+                kInvalid);
+}
+
+// --- Format versions ---
+
+function assertSameHistogram(actual, expected) {
+  assert.strictEqual(actual.count, expected.count);
+  assert.strictEqual(actual.min, expected.min);
+  assert.strictEqual(actual.max, expected.max);
+  assert.strictEqual(actual.percentile(50), expected.percentile(50));
+  assert.strictEqual(actual.percentile(100), expected.percentile(100));
+}
+
+{
+  // Version 1 data, as produced by Node.js v26.9.0, remains importable.
+  const v1 = Buffer.from(
+    'ac00010101021b001fffffffffffff030304070501061a075bcd15070008fb3f' +
+    'f00000000000000919b0000a8c010101010101190bfd02191fa101191bba010b' +
+    'a500fb3fc45d819a94b14c01fb4172dc620791dc2002fb431ce79e5650942003' +
+    'fb3fd2bec33301886804191388', 'hex');
+  const h = importHistogram(new Uint8Array(v1));
+  assert.strictEqual(h.count, 7);
+  assert.strictEqual(h.min, 1);
+  assert.strictEqual(h.max, 123469823);
+  assert.strictEqual(h.mean, 17777921.42857143);
+  assert.strictEqual(h.stddev, 43136537.01467338);
+  assert.strictEqual(h.percentile(50), 4099);
+  assert.strictEqual(h.percentile(100), 123469823);
+  assert.strictEqual(h.ewmaMean, 19777056.47311032);
+  assert.strictEqual(h.ewmaStddev, 45099796.52633914);
+  assert.strictEqual(h.ewmaErrorRate, 0.29289321881345254);
+}
+
+{
+  // export() produces version 2 data, which round-trips.
+  const h = createHistogram({ halfLife: 4, threshold: 5000 });
+  for (const value of [1, 2, 3, 4096, 4097, 1000000, 123456789]) {
+    h.record(value);
+  }
+  const data = h.export();
+  // The first map entry is the version.
+  assert.deepStrictEqual([...data.subarray(1, 3)], [...uint(0), ...uint(2)]);
+  const h2 = importHistogram(data);
+  assertSameHistogram(h2, h);
+  assert.strictEqual(h2.ewmaMean, h.ewmaMean);
+  assert.strictEqual(h2.ewmaErrorRate, h.ewmaErrorRate);
+}
+
+{
+  // Unknown keys in version 2 data are ignored, whatever their values are.
+  const unknownValues = [
+    uint(2n ** 40n),
+    negint(7),
+    [...head(2, 3), 1, 2, 3],                      // Byte string.
+    text('hello'),
+    array([uint(1), array([text('nested')])]),
+    map([[text('a'), uint(1)], [uint(99), map([[uint(1), f64(2.5)]])]]),
+    [...head(6, 1), ...text('2026-09-17')],        // Tag.
+    f64(1.5),
+    [0xf9, 0x3e, 0x00],                            // Float16.
+    [0xfa, 0x3f, 0xc0, 0x00, 0x00],                // Float32.
+    [0xf5],                                        // true
+    [0xf6],                                        // null
+    [0xf8, 0xff],                                  // Simple value 255.
+  ];
+  const expected = importBytes(
+    map([[uint(0), uint(2)], ...kLayout, counts(5, 2, 3, 1)]));
+  const h = importBytes(map([
+    [uint(0), uint(2)],
+    ...kLayout,
+    ...unknownValues.map((value, n) => [uint(12 + n), value]),
+    counts(5, 2, 3, 1),
+  ]));
+  assertSameHistogram(h, expected);
+
+  // Unknown keys may appear before the version key.
+  assertSameHistogram(importBytes(map([
+    [uint(12), text('before the version')],
+    [uint(0), uint(2)],
+    ...kLayout,
+    counts(5, 2, 3, 1),
+  ])), expected);
+
+  // Unknown keys in the EWMA state are ignored as well.
+  const withEwma = importBytes(map([
+    [uint(0), uint(2)],
+    ...kLayout,
+    counts(5, 2, 3, 1),
+    [uint(11), map([
+      [uint(0), f64(0.5)],
+      [uint(99), text('unknown')],
+      [uint(1), f64(6)],
+    ])],
+  ]));
+  assertSameHistogram(withEwma, expected);
+  assert.strictEqual(withEwma.ewmaMean, 6);
+}
+
+{
+  // Version 1 data, or data without a version, keeps the original semantics:
+  // unknown keys are rejected.
+  const unknown = [uint(12), uint(0)];
+  assert.throws(() => importBytes(map([[uint(0), uint(1)], ...kLayout, unknown])),
+                kInvalid);
+  assert.throws(() => importBytes(map([unknown, [uint(0), uint(1)], ...kLayout])),
+                kInvalid);
+  assert.throws(() => importBytes(map([...kLayout, unknown])), kInvalid);
+  assert.throws(() => importBytes(map([
+    [uint(0), uint(1)],
+    ...kLayout,
+    [uint(11), map([[uint(99), uint(0)]])],
+  ])), kInvalid);
+}
+
+// Other versions are rejected.
+for (const version of [0, 3, 99]) {
+  assert.throws(
+    () => importBytes(map([[uint(0), uint(version)], ...kLayout])),
+    kInvalid);
+}
+
+{
+  // Values of unknown keys must still be well-formed.
+  const withUnknownValue =
+    (value) => map([[uint(0), uint(2)], ...kLayout, [uint(12), value]]);
+
+  // Indefinite-length items are not supported.
+  assert.throws(() => importBytes(withUnknownValue([0x5f, 0x41, 0x00, 0xff])),
+                kInvalid);
+  assert.throws(() => importBytes(withUnknownValue([0x9f, 0x00, 0xff])),
+                kInvalid);
+  // Reserved additional information and break codes.
+  assert.throws(() => importBytes(withUnknownValue([0x1c])), kInvalid);
+  assert.throws(() => importBytes(withUnknownValue([0xfc])), kInvalid);
+  assert.throws(() => importBytes(withUnknownValue([0xff])), kInvalid);
+  // Truncated values.
+  assert.throws(() => importBytes(withUnknownValue([...head(3, 10), 0x61])),
+                kInvalid);
+  assert.throws(() => importBytes(withUnknownValue([0xfb, 0x00, 0x00])),
+                kInvalid);
+  assert.throws(() => importBytes(withUnknownValue(head(4, 5))), kInvalid);
+  // Nesting is limited to 16 levels.
+  const nested = (depth) => [...new Array(depth).fill(0x81), 0x00];
+  assert.strictEqual(importBytes(withUnknownValue(nested(16))).count, 0);
+  assert.throws(() => importBytes(withUnknownValue(nested(17))), kInvalid);
+}