Who contributed to Node.js on May 31, 2026?

3 developers shipped this update, including mcollina, Antamansid, and RajeshKumar11.

What were the notable Node.js updates?

fix: reset invalid HTTP/2 sessions, feat(connect): add `preferH2` connector option to offer h2 first in ALPN, and src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI PATCHES HTTP/2 SESSION COLLAPSE, NODE CORE HARDENS BUFFER ENCODING

By RepoJournal · Filed 06:01 UTC on May 31, 2026 · About Node.js

3 people shipped this

mcollina @mcollina 2 cited

Antamansid @Antamansid 1 cited

RajeshKumar11 @RajeshKumar11 1 cited

Undici's HTTP/2 client now auto-recovers from invalid sessions instead of failing hard, while Node core plugs a race condition that could corrupt SharedArrayBuffer-backed buffers during encoding.

The undici team shipped a critical fix that resets cached HTTP/2 session state when `session.request()` throws `ERR_HTTP2_INVALID_SESSION`, then requeues the unsent request on a fresh connection [1]. This prevents cascading failures in production where a single bad session could take down an entire client. In parallel, they're landing a connector feature that lets you prefer HTTP/2 in ALPN negotiation via a new `preferH2` option [2], solving interop headaches with load balancers that follow client preference. Over in Node core, Antoine du Hamel closed a TOCTOU race condition in SAB-backed buffer encoding that could lead to memory corruption [3], a quiet but serious fix tracked on HackerOne. The core team also cleaned up unused util functions [4] and fixed duplicated build conditions around sqlite and ffi [5]. HTTP header validation is getting more flexible too: the `insecureHTTPParser` option now gates lenient control-character handling to match the Fetch spec, letting Node interop with non-compliant servers without going fully permissive [6]. On the documentation front, undici's HTTP/2 trailers test is being refactored to use async/await patterns and shared fixtures instead of callbacks, eliminating flakiness [7].

Action items

→ If you're running undici in production with HTTP/2, verify your error handling works with the session reset behavior [ref:1] nodejs/undici [plan]
→ Review SAB usage in your codebase if you're encoding SharedArrayBuffer-backed buffers; update Node when this ships [ref:9] nodejs/node [immediate]
→ Test your HTTP header parsing with the new validation rules if you rely on `insecureHTTPParser` [ref:12] nodejs/node [monitor]

References

[1] fix: reset invalid HTTP/2 sessions ↗ nodejs/undici
[2] feat(connect): add `preferH2` connector option to offer h2 first in ALPN ↗ nodejs/undici
[3] src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s nodejs/node
[4] util: remove unused functions nodejs/node
[5] build: remove duplicated node_use_sqlite and node_use_ffi conditions nodejs/node
[6] http: align header value validation with Fetch spec ↗ nodejs/node
[7] test: fix flaky http2 trailers test ↗ nodejs/undici

Quick answers

What shipped in Node.js on May 31, 2026?: Undici's HTTP/2 client now auto-recovers from invalid sessions instead of failing hard, while Node core plugs a race condition that could corrupt SharedArrayBuffer-backed buffers during encoding. In total, 14 commits and 13 pull requests landed.
Who contributed to Node.js on May 31, 2026?: 3 developers shipped this update, including mcollina, Antamansid, and RajeshKumar11.
What were the notable Node.js updates?: fix: reset invalid HTTP/2 sessions, feat(connect): add `preferH2` connector option to offer h2 first in ALPN, and src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s.

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 1 day ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

@nodejs 2 days ago

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

javascript 17 shipped 1-min read

@nodejs 3 days ago

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

javascript 26 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.