Who contributed to Node.js on June 12, 2026?

3 developers shipped this update, including DucMinhNe, brianathere, and trivikr.

What were the notable Node.js updates?

fix(h2): do not rewind kPendingIdx past in-flight requests, vm: fix property queries for proxy sandboxes, and fix(cookies): preserve values and parse SameSite strictly.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI HTTP/2 CRASH FIXED, VM PROXY SANDBOX QUERIES CORRECTED

By RepoJournal · Filed 06:01 UTC on June 12, 2026 · About Node.js

3 people shipped this

DucMinhNe @DucMinhNe 1 cited

brianathere @brianathere 1 cited

trivikr @trivikr 1 cited

Undici shipped a critical fix for HTTP/2 multiplexing that was crashing processes when two requests shared a session, while Node core fixed vm sandboxes backed by Proxies to properly report property ownership.

The undici team patched a catastrophic bug [1] where rewinding kPendingIdx past nulled queue slots during HTTP/2 multiplexing would crash the entire process with a TypeError when Client[kDestroy] tried to error remaining requests. The root cause: when two requests multiplexed on one session, closing one stream before response headers would unconditionally reset kPendingIdx while the other request was still in flight, leaving a null slot that later crashed with Cannot read properties of null. This is a production blocker for anyone using HTTP/2 multiplexing in high-concurrency scenarios.

Node core fixed a separate but equally nasty issue [2] where vm contextify was using HasRealNamedProperty() instead of inspecting own property descriptors, making Proxy-backed sandboxes report false for hasOwnProperty, Object.hasOwn, in, and Reflect.has even when properties were actually readable. The fix updates the named property query path to see through Proxy objects, restoring correct property visibility semantics.

Undici also landed tighter cookie parsing [3] that now preserves values and parses SameSite strictly, plus cache header fixes [4] for qualified field name trimming. On the test side, Node marked SEA build tests flaky on linux arm debug [5] after observing SIGKILL crashes during ELF binary injection, and bumped OpenSSL to 3.5.7 [6] across all architectures.

Action items

→ Update undici immediately if you use HTTP/2 multiplexing - this crashes production nodejs/undici [immediate]
→ Review vm Proxy-backed sandboxes if you rely on property queries - behavior changed nodejs/node [plan]
→ Expect SEA test noise on linux arm debug CI until stabilized nodejs/node [monitor]

References

[1] fix(h2): do not rewind kPendingIdx past in-flight requests ↗ nodejs/undici
[2] vm: fix property queries for proxy sandboxes ↗ nodejs/node
[3] fix(cookies): preserve values and parse SameSite strictly nodejs/undici
[4] fix(cache): trim qualified field names nodejs/undici
[5] test: mark SEA tests flaky on linux arm debug ↗ nodejs/node
[6] deps: update archs files for openssl-3.5.7 nodejs/node

Quick answers

What shipped in Node.js on June 12, 2026?: Undici shipped a critical fix for HTTP/2 multiplexing that was crashing processes when two requests shared a session, while Node core fixed vm sandboxes backed by Proxies to properly report property ownership. In total, 8 commits and 3 pull requests landed.
Who contributed to Node.js on June 12, 2026?: 3 developers shipped this update, including DucMinhNe, brianathere, and trivikr.
What were the notable Node.js updates?: fix(h2): do not rewind kPendingIdx past in-flight requests, vm: fix property queries for proxy sandboxes, and fix(cookies): preserve values and parse SameSite strictly.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.