Who contributed to Node.js on June 9, 2026?

2 developers shipped this update, including nodejs-github-bot and owlstronaut.

What were the notable Node.js updates?

fix: guard idle socket validation to skip fresh sockets, fix: handle paused parser on socket end (issue #5360) (#5389), and fix(client): reject pipelined TLS altname errors (#5373).

Jun 9, 2026

$ the-wire · showcase

UNDICI PATCHES CRITICAL SOCKET VALIDATION BUG AS NODE CORE DEPENDENCY UPDATES SHIP

By RepoJournal · Filed 06:01 UTC on June 9, 2026 · About Node.js · Composed from the cited sources · methodology

2 people shipped this

nodejs-github-bot @nodejs-github-bot 4 cited

owlstronaut @owlstronaut 1 cited

Undici 8.4.0 lands in Node core with three production fixes that prevent socket assertion crashes, TLS hostname rejections, and parser hangs under backpressure.

The headline story is a guard on idle socket validation that was silently failing fresh sockets [1], paired with a critical parser fix that removes an uncatchable assertion when the HTTP/1 parser is paused and the socket ends [2]. That second fix matters because backpressured requests (body not consumed) were throwing AssertionErrors from the socket 'end' handler - a silent killer in production. A third fix ensures pipelined TLS altname errors reject requests instead of tripping queue assertions [3]. Node core already shipped undici 8.4.0 [4], so you're getting these fixes in your next Node release. Separately, Node bumped ngtcp2 to 1.23.0 [5], nghttp3 to 1.16.0 [6], and sqlite to 3.53.2 [7], all routine but worth monitoring for QUIC/HTTP/3 behavior changes. Node-gyp broke compatibility with versions below Node 22.22.2 [8], aligned with npm's upcoming engine range [9], so if you're on 20.x you're on borrowed time for native module builds.

Action items

→ Review undici socket and parser fixes before deploying HTTP/1 workloads under backpressure nodejs/undici [plan]
→ Update node-gyp if you're shipping native modules; drop support for Node <22.22.2 nodejs/node-gyp [plan]
→ Monitor ngtcp2 and nghttp3 updates for QUIC/H3 edge cases in your infrastructure nodejs/node [monitor]

References

[1] fix: guard idle socket validation to skip fresh sockets ↗ nodejs/undici
[2] fix: handle paused parser on socket end (issue #5360) (#5389) ↗ nodejs/undici
[3] fix(client): reject pipelined TLS altname errors (#5373) ↗ nodejs/undici
[4] deps: update undici to 8.4.0 ↗ nodejs/node
[5] deps: update ngtcp2 to 1.23.0 ↗ nodejs/node
[6] deps: update nghttp3 to 1.16.0 ↗ nodejs/node
[7] deps: update sqlite to 3.53.2 ↗ nodejs/node
[8] feat!: bump to new node engine range ↗ nodejs/node-gyp
[9] Bump engine version ↗ nodejs/node-gyp