RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

Pick a date

The Wire · Showcase

UNDICI FIXES FLAKY WEBSOCKET TESTS AND DEAD ASSERTIONS

By RepoJournal · Filed · About Node.js

Undici shipped three critical stability fixes overnight that eliminate unreachable code paths and deterministic test failures across websockets and HTTP dispatching.

The HTTP dispatcher had a dead assertion checking contentLength equality [1] — a condition that could never fail because writeH1 and writeH2 already normalize the value before invoking writeBlob. Killing dead code matters because it reduces cognitive load on maintainers and prevents future bugs hiding in unreachable branches. Meanwhile, the websocket test suite was leaking race conditions [2] that made send tests flaky; the fix refactors to async/await with proper cleanup registration, ensuring deterministic teardown before assertions run. A third patch [3] relaxes Content-Range parsing to accept unknown-size values, fixing a real-world interop issue. Core also landed a SubtleCrypto.supports() accuracy fix [4] that validates ECDH shared-secret output matches requested lengths — this closes a gap where algorithm support claims could be misleading. The crypto desk also optimized normalizeAlgorithm dispatch [5] by replacing O(n) case-insensitive scans with O(1) SafeMap lookups, a hot-path win for workloads calling crypto methods repeatedly.

Action items

References

  1. [1] fix(dispatcher): remove unreachable assert in writeBlob (#5231) nodejs/undici
  2. [2] test(websocket): fix flaky send test ↗ nodejs/undici
  3. [3] fix: accept unknown-size Content-Range values ↗ nodejs/undici
  4. [4] crypto: improve accuracy of SubtleCrypto.supports ↗ nodejs/node
  5. [5] crypto: optimize normalizeAlgorithm dispatch hot path nodejs/node

FAQ

What changed in Node.js on May 7, 2026?
Undici shipped three critical stability fixes overnight that eliminate unreachable code paths and deterministic test failures across websockets and HTTP dispatching.
What should Node.js teams do about it?
Test your websocket implementation against latest undici — the flaky test fixes may surface real issues you've been masking • Verify Content-Range handling in your HTTP clients if serving range requests [ref:4] • Audit SubtleCrypto.supports() calls if you're relying on ECDH algorithm support detection
Which Node.js repositories shipped on May 7, 2026?
nodejs/undici, nodejs/node

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • 14 famous open source orgs
  • One wire per day
  • Public, generic
  • Read on the web, when you remember

Your wire

  • Up to 1,500 of your repos - orgs, deps, vendors
  • Morning and evening briefs
  • Action items routed to your team
  • Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.