Who contributed to Node.js on June 13, 2026?

3 developers shipped this update, including mcollina, KhafraDev, and arcanis.

What were the notable Node.js updates?

websocket: limit the number of fragments in a message, fix: reap idle HTTP/2 sessions, and fix: allow h2 post request multiplexing.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI PLUGS WEBSOCKET DOS WHILE NODE CORE OPTIMIZES BUFFERS AND ADDS PACKAGE MAPS

By RepoJournal · Filed 06:01 UTC on June 13, 2026 · About Node.js

3 people shipped this

mcollina @mcollina 2 cited

KhafraDev @KhafraDev 1 cited

arcanis @arcanis 1 cited

Undici shipped a critical websocket fragment limit to prevent remote OOM attacks, while Node core lands experimental package map support and a V8 API that cuts Buffer.copy overhead.

The undici team shipped a breaking change that closes a denial-of-service hole: a remote peer could send thousands of tiny websocket fragments, consuming far more memory than the payload itself and crashing the process [1]. Without the new `maxFragments` option, connections hit the limit and close with code 1008. This is a you-need-to-know security fix if you're running websocket servers at scale.

On the Node core side, three major improvements landed. The experimental `--experimental-package-map` flag lets you resolve packages from a static JSON file instead of walking `node_modules`, solving phantom dependency issues and speeding up startup [6]. Buffer.prototype.copy got a significant speedup through V8's new `CopyArrayBufferBytes` API [7][8], which handles the copy at the native level without materializing intermediate objects. For HTTP/2 users, undici fixed idle session reaping so `keepAliveTimeout` is actually honored after streams complete [2], and it now allows multiplexing non-idempotent requests on independent H/2 streams [3]. There's also a fix ensuring ProxyAgent respects `requestTls` settings when using SOCKS5 proxies [4].

TextStream support landed in undici to match the fetch spec [5], rounding out the standards compliance push.

Action items

→ Review undici websocket usage - upgrade to get maxFragments limit on public-facing connections nodejs/undici [immediate]
→ Benchmark Buffer.copy performance gains in your workload after next Node LTS nodejs/node [plan]
→ Test --experimental-package-map flag if you're hitting node_modules phantom dependency issues nodejs/node [monitor]
→ Verify HTTP/2 session keepAliveTimeout behavior in production after undici update nodejs/undici [plan]

References

[1] websocket: limit the number of fragments in a message nodejs/undici
[2] fix: reap idle HTTP/2 sessions ↗ nodejs/undici
[3] fix: allow h2 post request multiplexing ↗ nodejs/undici
[4] fix: honor requestTls when proxy is SOCKS5 nodejs/undici
[5] add bodymixin.textStream() ↗ nodejs/undici
[6] loader: implement package maps ↗ nodejs/node
[7] buffer: optimize Buffer.prototype.copy nodejs/node
[8] deps: V8: add CopyArrayBufferBytes API nodejs/node

Quick answers

What shipped in Node.js on June 13, 2026?: Undici shipped a critical websocket fragment limit to prevent remote OOM attacks, while Node core lands experimental package map support and a V8 API that cuts Buffer.copy overhead. In total, 14 commits and 9 pull requests landed.
Who contributed to Node.js on June 13, 2026?: 3 developers shipped this update, including mcollina, KhafraDev, and arcanis.
What were the notable Node.js updates?: websocket: limit the number of fragments in a message, fix: reap idle HTTP/2 sessions, and fix: allow h2 post request multiplexing.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.